Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker w...

CVE-2026-13372

Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026

历史摘要 · 未重新核验 · NVD

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the ydoc:document:join Socket.IO handler checks note ownershi...

CVE-2026-54022

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the

历史摘要 · 未重新核验 · NVD

Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is re...

CVE-2026-54282

Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being u

历史摘要 · 未重新核验 · NVD

Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI...

CVE-2026-10696

Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier all

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

CVE-2026-54022

### Summary The `ydoc:document:join` Socket.IO handler checks note ownership only when the `document_id` starts with `n

历史摘要 · 未重新核验 · GitHub Advisory

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

CVE-2026-54282

### Summary In affected versions, the HTTP request path is not validated before being used to reconstruct `request.url`

历史摘要 · 未重新核验 · GitHub Advisory

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir...

CVE-2026-45306

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509

历史摘要 · 未重新核验 · NVD

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7,...

CVE-2026-8716

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, an

历史摘要 · 未重新核验 · GitHub Advisory

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could ...

CVE-2026-8716

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, an

历史摘要 · 未重新核验 · NVD

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ...

CVE-2026-40912

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high s

历史摘要 · 未重新核验 · NVD

Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation

# Summary The Hickory DNS project's experimental `hickory-recursor` crate's record cache (`DnsLru`) stores records from

历史摘要 · 未重新核验 · GitHub Advisory