Open Source Vulnerabilities
open-webui
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
open-webui
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
open-webui
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
open-webui
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
open-webui
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
open-webui
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
@jhb.software/payload-alt-text-plugin
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
@jhb.software/payload-alt-text-plugin
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
@argos-ci/core
@argos-ci/core: CI Branch Name OS Command Injection
@argos-ci/core
@argos-ci/core: CI Branch Name OS Command Injection
psd-tools, psd-tools, psd-tools
spark-4.0-scala-2.13, spark-4.0-scala-2.13
GoBGP confederation validation panics on empty AS_PATH attribute
GoBGP confederation validation panics on empty AS_PATH attribute
GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries
GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries
mistralrs-server-core
mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS
mistralrs-server-core
mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS
mistralrs-server-core
mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url
mistralrs-server-core
mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url
Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects
Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects
Suricata lua: excessive flow variable registration can bypass sandbox
Suricata lua: excessive flow variable registration can bypass sandbox
ikev2: unbounded client transform storage can lead to resource exhaustion
ikev2: unbounded client transform storage can lead to resource exhaustion
Suricata ldap: unbounded responses per transaction can lead to resource exhaustion
Suricata ldap: unbounded responses per transaction can lead to resource exhaustion
Suricata datasets: save to absolute filename can be bypassed when combined with load command
Suricata datasets: save to absolute filename can be bypassed when combined with load command
Suricata nfs: unbounded stateful structures can lead to resource exhaustion
Suricata nfs: unbounded stateful structures can lead to resource exhaustion
Suricata dnp3: unbounded reassembly can lead to resource exhaustion
Suricata dnp3: unbounded reassembly can lead to resource exhaustion
open-webui
Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
open-webui
Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
open-webui
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
open-webui
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
omniroute
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
omniroute
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
n8n, n8n
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
n8n/ n8n
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
n8n, n8n
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
n8n/ n8n
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
r-cran-readxl, r-cran-readxl, r-cran-readxl
r-cran-readxl, r-cran-readxl, r-cran-readxl
n8n, n8n, n8n
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
n8n/ n8n/ n8n
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
Suricata http2: protocol-change type confusion can lead to denial of service
Suricata http2: protocol-change type confusion can lead to denial of service
n8n, n8n
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
n8n/ n8n
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
Suricata defrag: missing address-family check can lead to remote crash
Suricata defrag: missing address-family check can lead to remote crash
