2026-05-16 归档

今日共收录 1030 条安全情报，包含 296 个 CVE，439 篇安全通告，以及 15 篇研究论文。

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, validate_url() in backend/open_webui/retrieval/web/utils.py ca...

CVE-2026-45331

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, valid

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the AccountPending.svelte component renders the admin-configur...

CVE-2026-44568

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the A

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the ydoc:document:update Socket.IO event handler checks whethe...

CVE-2026-44564

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the y

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /api/generate, /api/embed, /api/embeddings, and /api/show ...

CVE-2026-44563

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the POST /api/v1/models/import endpoint allows users with the ...

CVE-2026-44562

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the P

历史摘要 · 未重新核验 · NVD

#cve #cwe-283 #cwe-862

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the is_user_channel_member function checks whether a ChannelMe...

CVE-2026-44561

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the i

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the GET /api/v1/channels/{id}/members endpoint only checks mem...

CVE-2026-44559

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the G

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI supports model composition via base_model_id: a use...

CVE-2026-44555

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the POST /api/v1/retrieval/process/web endpoint accepts a user...

CVE-2026-44554

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the P

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, administrative role changes and user deletions do not iterate ...

CVE-2026-44553

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, admin

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the tool_servers and terminal_servers keys in utils/tools.py d...

CVE-2026-44552

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the t

历史摘要 · 未重新核验 · NVD

#cve #cwe-668

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, FolderForm uses model_config = ConfigDict(extra='allow'), whic...

CVE-2026-44550

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Folde

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-15 发布INFO

ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsys...

CVE-2025-67031

ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnera

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-05-15 发布INFO

Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by sending a crafted packet. To remedia...

CVE-2026-8686

Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a den

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-05-15 发布INFO

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-...

CVE-2026-4054

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxie

历史摘要 · 未重新核验 · NVD

#cve #cwe-754

漏洞预警2026-05-15 发布INFO

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file...

CVE-2026-4053

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fiel

历史摘要 · 未重新核验 · NVD

#cve #cwe-672

漏洞预警2026-05-15 发布INFO

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id...

CVE-2026-46408

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-15 发布INFO

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authent...

CVE-2026-46407

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-15 发布INFO

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in commen...

CVE-2026-46367

phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticate

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-15 发布INFO

phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to...

CVE-2026-46366

phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks pe

历史摘要 · 未重新核验 · NVD

#cve #cwe-863