7927 matches found
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
SummaryOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and doe...
Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
SummaryWith the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pag...
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
SummaryOpen WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user's browser issue attacker-chosen outbound GET...
PYSEC-2026-3623
Apache Polaris did not consistently validate storage locations supplied during table and view registration.An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials ...
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
SummaryThumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C code triggers undefined behavior; on x8664 this reliably results in a...
linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect
Summarylib.url.fetch follows HTTP redirects followredirects=True. httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header a session token such as Redfish's X-Auth-Token, an API key, ... was still sent to the redirect target. A...
Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive
SummaryPenelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such a...
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
Summarydatamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form "..." with a literal \r escape, is rendered into a Python comment by a Jinja2 filter that...
pypdf: Possible infinite loop for not terminated inline images
ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. PatchesThis has been fixed in pypdf==6.14.1. WorkaroundsIf you...
PYSEC-2026-3452
Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open to seek backwards to the same directive and parse it repeatedly in an infinite...
PYSEC-2026-3453
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.applyim, imOut API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0...
pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs
Summaryisglobaladdress in src/pyload/core/utils/web/check.py is the central guard against SSRF-style outbound connections in pyload-ng. It tests whether a given IP is "globally routable" via Python's ipaddress.ipaddressvalue.isglobal, and callers treat not isglobal as "deny":pythondef...
Langroid: handle_message() executes user-supplied tool JSON without sender verification
SummaryA Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with use=False, handle=True. Detailsenablemessage..., use=False, handle=True only prevents the LLM from being instructed to generate th...
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
Summary When verifying an uploaded certificate, lemur/certificates/verify.py extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An...
LangGraph SDK has unsafe URL path construction
Summarylanggraph-sdk constructs HTTP request paths for resource operations by interpolating caller-supplied identifier values into URL templates. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resulting request to addres...
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via the Anthropic API routerResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchSeverity: CVSS 3.1 5.3 Medium AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NTarget: https://github.com/vllm-project/vllm---...
Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
SummaryLangflow is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw ...
WsgiDAV encoded dot segments can escape filesystem share roots
ImpactWsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. PatchesThe issue is fixed with version 4.3.4. PreconditionsThe practical impact depends on the deployment.The deployment use...
pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams
ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W 0 0 0 values and large /Size values. PatchesThis has been fixed in pypdf==6.12.0. WorkaroundsIf developers are unable to upgrade their apps immediately, they...
Bugsink: DOS using large numbers of event tags
SummaryIn affected versions, Bugsink stores every tag supplied with an incoming event. An event with an unusually large numberof custom i.e. supplied by an attacker tags can therefore make ingestion spend more time than intended writing tag rows.Bugsink uses a single-writer database architecture...
praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
SummaryType: Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on requireworkspacememberworkspaceid only, then resolve projectid through ProjectService.getprojectid / updateprojectid...
zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
ImpactDNSIncoming.logexceptiondebug and the four QuietLogger exception-dedup methods stored an unbounded seenlogs dict keyed by strsys.excinfo1. The seven IncomingDecodeError messages raised from readname / decodelabelsatoffset RFC 6762 §18 name-decoding error paths all embed self.source — the...
Snorkel Trainer.load uses an unsafe torch.load
The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability CWE-502 in the Trainer.load method of the Trainer class. The method loads model checkpoint files using torch.load without enabling the security-restrictive weightsonly=True parameter. This default behavior allows...
Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
CONFIDENTIAL KL-CAN-2024-002 Vulnerability Details| | Field | Value ||---|-------|-------|| 1 | Discoverer | Jaggar Henry & Sean Segreti of KoreLogic, Inc. || 2 | Date Submitted | 2024.03.12 || 3 | Title | Open WebUI Arbitrary File Upload + Path Traversal || 5 | Affected Vendor | Open WebUI || 6 ...
Open WebUI has stored XSS in Excel file preview
SummaryExcel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheettohtml to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via @html causing the payload to trigger. DetailsThe...
misp-modules has nsafe remote resource fetching in expansion
An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The htmltomarkdown module accepted arbitrary HTTPS URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally...
requests-hardened is Vulnerable to Server-Side Request Forgery
The SSRF protection in requests-hardened prior to version 1.2.1 fails to block IP addresses within the RFC 6598 Shared Address Space 100.64.0.0/10. An attacker who can supply arbitrary URLs to requests-hardened could exploit this gap to access internal services hosted within 100.64.0.0/10. This i...
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
SummaryThe DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...
PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
| Field | Value ||---|---|| Severity | High || Type | SSRF -- unvalidated URL in webcrawl httpx fallback allows internal network access || Affected | src/praisonai-agents/praisonaiagents/tools/webcrawltools.py:133-180 | Summarywebcrawl's httpx fallback path passes user-supplied URLs directly to...
Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)
Stored Cross-Site Scripting XSS in the genai/evalsvisualization component of Google Cloud Vertex AI SDK google-cloud-aiplatform versions from 1.98.0 up to but not including 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment...
MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access
ImpactServer-Side Request Forgery SSRF:A security vulnerability exists in the mcp-run-python tool specifically within the Pydantic-AI integration due to an overly permissive Deno sandbox configuration.The tool configures the Deno runtime—which is intended to isolate the execution of untrusted...
TensorFlow has Null Pointer Error in TensorArrayConcatV2
ImpactWhen ctx-stepcontainter is a null ptr, the Lookup function will be executed with a null pointer.pythonimport tensorflow as tftf.rawops.TensorArrayConcatV2handle='a', 'b', flowin = 0.1, dtype=tf.int32, elementshapeexcept0=1 PatchesWe have patched the issue in GitHub commit...
TensorFlow vulnerable to `CHECK` fail in `SetSize`
ImpactWhen SetSize receives an input setshape that is not a 1D tensor, it gives a CHECK fails that can be used to trigger a denial of service attack.pythonimport tensorflow as tfarg0=1arg1=1,1arg2=1arg3=Truearg4=''tf.rawops.SetSizesetindices=arg0, setvalues=arg1, setshape=arg2,...
TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannel`
ImpactIf FakeQuantWithMinMaxVarsPerChannel is given min or max tensors of a rank other than one, it results in a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tfnumbits = 8narrowrange = Falseinputs = tf.constant0, shape=4, dtype=tf.float32min =...
OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption
The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service memory and disk consumption via a crafted disk image. This iss...
Out-of-bounds Read in OpenCV
An out-of-bounds read was discovered in OpenCV before 4.1.1 OpenCV-Python before 4.1.0.25. Specifically, variable coarsestscale is assumed to be greater than or equal to finestscale within the calc/oclcalc functions in disflow.cpp. However, this is not true when dealing with small images, leading...
Out-of-bounds Read in OpenCV
In OpenCV 3.3.1 corresponding with OpenCV-Python 3.3.1.11, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmthdr.cpp...
protobuf affected by a JSON recursion depth bypass
A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages.Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supp...
WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
SummaryA Server-Side Request Forgery SSRF Protection Bypass exists in WeasyPrint's defaulturlfetcher. The vulnerability allows attackers to access internal network resources such as localhost services or cloud metadata endpoints even when a developer has implemented a custom urlfetcher to block...
NiceGUI has Redis connection leak via tab storage causes service degradation
SummaryAn unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit.NiceGUI continues accepting ne...
LIEF is vulnerable to segmentation fault
A security flaw has been discovered in lief-project LIEF up to 0.17.1. Affected by this issue is the function Parser::parsebinary of the file src/ELF/Parser.tcc of the component ELF Binary Parser. The manipulation results in null pointer dereference. The attack must be initiated from a local...
open-webui is Vulnerable to Incorrect Access Control
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
ComposioHQ has a directory traversal vulnerability
Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the downloadfileordir function...
urllib3 allows an unbounded number of links in the decompression chain
Impacturllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 e.g., Content-Encoding: gzip, zstd.However, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leadi...
trytond allows remote attackers to obtain sensitive trace-back (server setup) information
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back server setup information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...
Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input
ImpactIn affected versions, brotli "bombs" highly compressed brotli streams, such as many zeros can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the available memory and thus a Denial of...
BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver
SummaryDue to unsafe URL handling, bbot's gitclone.py can be made to leak a user's github.com API key to an attacker-controlled webserver. ImpactA user who has placed their github.com API key in the configuration for any of the following modules: githubcodesearch githubworkflows gitlab gitclone...
OMERO.web displays unecessary user information when requesting password reset
BackgroundIf an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. ImpactOMERO.web before 5.29.1 PatchesUser should upgrade to 5.29.2 or higher WorkaroundsDisable the...
Aim vulnerable to Cross-site Scripting
Cross-site Scripting XSS in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox...