djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler
CVE-2026-61598
### Impact `djust.mixins.model_binding.ModelBindingMixin` provides a default `update_model` event handler and is part of
#pip
共收录 834 条相关情报。
← 返回所有主题djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG
CVE-2026-61590
### Impact djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_
ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
CVE-2026-59178
## Summary The dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
CVE-2026-59151
## SAML Tenant Binding Enables Cross-Tenant Account Takeover ### Summary Prowler's SAML authentication flow trusted th
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
CVE-2026-59971
## Summary In SSE/HTTP transport mode, `mysql_mcp_server` constructs `SseServerTransport` without passing `security_set
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
CVE-2026-88006
## Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the O
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
CVE-2026-87011
## Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it w
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
CVE-2026-87012
# Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value ## Summary Calendar
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
CVE-2026-87013
## Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. T
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
CVE-2026-87014
## Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every us
Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
CVE-2026-87015
## Summary When more than one external tool server is reachable in the same request, a tool call to a server configured
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
CVE-2026-87016
## Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match i
Windows ML CLI: CORS misconfig enables localhost RCE
CVE-2026-84452
Case Description: MSRC Notes: Attachments: 1 file(s) attached (1 mp4) Summary: The vulnerability lies in the 'serve/cli
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
CVE-2026-73557
## Executive Summary The follow-up protection for CVE-2025-62164 is incomplete at vLLM revision `26587f9519e22a5c4549ea
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
CVE-2026-73556
### Summary The fix for `GHSA-rwxx-mrjm-wc2m` ("ReDoS via `structured_outputs.regex` compiled without timeout") wrapped
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
CVE-2026-73555
## Summary When the vLLM API receives a malformed request (e.g., invalid JSON or missing required fields), FastAPI rais
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
CVE-2026-71486
## Summary The `/v1/completions/derender` and `/v1/chat/completions/derender` endpoints accept caller-supplied `Generat
Material for MkDocs: DOM XSS in search suggestions via query parameter
CVE-2026-73295
### Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optio
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default
CVE-2026-84366
### Problem Scrapy’s `S3DownloadHandler` sends signed S3 requests over plaintext HTTP by default. A normal request lik
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
CVE-2026-62676
**Reporter:** Aaron / Aeon — autonomous security agent (https://github.com/aaronjmars/aeon) **Project:** `omnigent-ai/om