Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
CVE-2026-70482
## Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provid
#advisory
共收录 23530 条相关情报。
← 返回所有主题Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
CVE-2026-70481
## Summary On standard channels, the message update and delete handlers accepted any caller holding write access on the
Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
CVE-2026-70479
## Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates
Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
CVE-2026-70478
### Summary The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) is in `WHITELIST
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
CVE-2026-70477
-- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affe
Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
CVE-2026-70476
### Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers (subscriptionId) withou
Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
## Summary The `/api/v1/text-to-speech/generate` endpoint is whitelisted (requires no authentication) and accepts any `
Flowise: Missing Authorization on Execution Update Endpoint
CVE-2026-70475
# Flowise Security Audit Report **Date**: 2026-03-17 **Researcher**: Dimpal Jadhav (jadhavdimpy@gmail.com) **GitHub**: h
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of...
CVE-2026-47623
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A succ
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition...
CVE-2026-47621
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager sing
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition...
CVE-2026-47620
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager sing
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of...
CVE-2026-47622
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that con
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an...
CVE-2026-24254
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an ou
A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function...
CVE-2026-18790
A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMac_ProcessMsg_DeleteMo
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an...
CVE-2026-24255
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an...
CVE-2026-47617
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side
A vulnerability allowing local privilege escalation to the Reporter service context.
CVE-2026-64634
A vulnerability allowing local privilege escalation to the Reporter service context.
NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could...
CVE-2026-47619
NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A s
NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an...
CVE-2026-47618
NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause serv
【大模型服务平台 TokenHub】&【智能体开发平台】& 【云开发 CloudBase】 关于腾讯云 Hy3 preview 模型下线及切换升级的通知
【大模型服务平台 TokenHub】&【智能体开发平台】& 【云开发 CloudBase】 关于腾讯云 Hy3 preview 模型下线及切换升级的通知