Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange
CVE-2026-109283
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads
2026-10-13 归档
今日共收录 1460 条安全情报，包含 709 个 CVE，466 篇安全通告，以及 13 篇研究论文。
← 返回归档列表Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
【防火墙管理】结束公测并正式计费公告
【防火墙管理】结束公测并正式计费公告
Ledger confirms spy chip implant behind wallet crypto thefts
Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP...
CVE-2026-89111
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause...
CVE-2026-82101
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to...
CVE-2026-82110
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain...
CVE-2026-82103
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike Announces Continuous Identity for AI Agents
ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation
CVE-2026-109374
ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user im
Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation
CVE-2026-109358
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer w
Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex
CVE-2026-109298
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a r
Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop
CVE-2026-109295
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authentic
Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID
CVE-2026-109287
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify
Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata
CVE-2026-109285
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets fo
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
CVE-2026-109372
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent