Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
CVE-2026-70483
## Summary `DELETE /api/v1/chats/{id}` cancelled a chat's in-flight tasks before it checked whether the caller was allow
2026-08-05 归档
今日共收录 766 条安全情报，包含 0 个 CVE，370 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
CVE-2026-70482
## Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provid
Flowise: Missing Authorization on Execution Update Endpoint
CVE-2026-70475
# Flowise Security Audit Report **Date**: 2026-03-17 **Researcher**: Dimpal Jadhav (jadhavdimpy@gmail.com) **GitHub**: h
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Firewall for AI
Akamai 安全研究团队发布了题为“Firewall for AI”的文章，介绍了一款面向人工智能应用的防火墙产品。该产品旨在保护 AI 模型和应用免受分布式拒绝服务（DDoS）攻击以及由僵尸网络（botnet）发起的恶意流量。文章标签包
[原创]Pwn2Own 击穿微软 Edge 全链路漏洞分析｜deepsec 攻防实录
[原创]Pwn2Own 击穿微软 Edge 全链路漏洞分析｜deepsec 攻防实录
Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows...
CVE-2026-18907
Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via direc
A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18...
CVE-2026-18852
A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This imp
Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows...
CVE-2026-70620
Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attacke
A security vulnerability has been detected in ZomboDroid Meme Generator App 4.6830 on Android....
CVE-2026-18853
A security vulnerability has been detected in ZomboDroid Meme Generator App 4.6830 on Android. This issue affects the fu
A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10...
CVE-2026-52370
A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execu
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers...
CVE-2026-70554
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary cod
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX...
CVE-2026-70552
MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthe
MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers...
CVE-2026-70553
MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP
Atlas-Livre contains an improper access control vulnerability in the admin controllers under...
CVE-2026-69703
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ th
Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow. An...
CVE-2017-20242
Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow. An unauthenticated remote attacker ca
Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow. An...
CVE-2017-20241
Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow. An unauthenticated remote attacker can
In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free....
CVE-2026-0163
In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to rem
Ghost: Mobiledoc image-size fetch SSRF
CVE-2026-53946
### Impact When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to