362 matches found
Open WebUI 'LDAP Empty Password' - Authentication Bypass
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...
Astra Linux – Vulnerability in Jetty9
In Eclipse Jetty versions 9.4.0 through 9.4.46, and 10.0.0 through 10.0.9, as well as 11.0.0 through 11.0.9, the parsing of the authority segment of an http scheme URI causes the Jetty HttpURI class to incorrectly detect an invalid input as a hostname. This can lead to failures in a Proxy scenari...
BIT-TOMCAT-2026-24733 Apache Tomcat: Security constraint bypass with HTTP/0.9
Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a specification inval...
NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling
NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, 6.21.1...
WordPress Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin <= 5.0.9 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by NOn Nss in WordPress Plugin Taskbuilder versions = 5.0.9...
CVE-2016-0009
creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:22+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-07-30 00:01:52+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-08-01 11:00:08+00:00| seen|...
CVE-2026-27422
Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2...
CVE-2026-44230
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...
EUVD-2026-44967
Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Englightenment Project...
2026-07 Cumulative Update for Windows 10 Version 1607 for x64-based Systems (KB5099535)
2026-07 Cumulative Update for Windows 10 Version 1607 for x64-based Systems KB5099535...
[SECURITY] Fedora 44 Update: librabbitmq-0.17.0-1.fc44
This is a C-language AMQP client library for use with AMQP servers speaking protocol versions 0-9-1...
CVE-2026-42219 Frappe: Path Traversal via /backups Route
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via downloadbackups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0...
CVE-2026-57218 RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...
CVE-2026-57218
RabbitMQ AMQP 0-9-1 vulnerability (CVE-2026-57218) allows an existing consumer to continue receiving messages after OAuth token expiry or update_secret refresh, due to channel user state changes not triggering reauthorization at delivery time. Root cause: existing consumers are not canceled or re...
CVE-2026-57216 RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend...
EUVD-2026-42727
A vulnerability was detected in lo48576 fbxcel up to 0.9.0. This affects an unknown part of the file src/pullparser/v7400/parser.rs of the component Node Header Handler. The manipulation results in denial of service. The attack must be initiated from a local position. The exploit is now public an...
CVE-2026-60108 Zeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzer
Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit t...
tomcat: security constraint bypass with HTTP/0.9
A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0...
