#CVE

共收录 70327 条相关情报。

漏洞预警2026-10-12 发布INFO

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attack...

CVE-2026-109304

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig cr

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-12 发布INFO

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using the...

CVE-2026-109303

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authentica

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operation...

CVE-2026-109302

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to oper

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-12 发布INFO

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an...

CVE-2026-109301

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing

历史摘要 · 未重新核验 · NVD

#cve #cwe-248

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool o...

CVE-2026-109300

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, whic

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting un...

CVE-2026-109299

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with auto

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-12 发布INFO

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unboun...

CVE-2026-109298

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a r

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-12 发布INFO

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more str...

CVE-2026-109297

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator,

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-12 发布INFO

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backen...

CVE-2026-109296

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disable

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patter...

CVE-2026-109295

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authentic

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed...

CVE-2026-109294

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-400

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source...

CVE-2026-109293

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admi

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browse...

CVE-2026-109292

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: ...

CVE-2026-109291

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading cr...

CVE-2026-109290

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that all

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open te...

CVE-2026-109289

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to ke

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-10-12 发布INFO

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validati...

CVE-2026-109288

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which rend

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested kn...

CVE-2026-109287

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by...

CVE-2026-109286

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-346

漏洞预警2026-10-12 发布INFO

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via st...

CVE-2026-109285

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets fo

历史摘要 · 未重新核验 · NVD

#cve #cwe-863