Weblate SSRF: outbound URL guard misses some private ranges
CVE-2026-50127
### Impact Weblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addre
#pip
共收录 834 条相关情报。
← 返回所有主题Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion
### Summary Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn ass
ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
### Summary In add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path **and** at the bar
aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address
CVE-2026-53533
### Summary `aiosmtplib`'s `SMTP.mail()`, `SMTP.rcpt()`, `SMTP.vrfy()` and `SMTP.expn()` send the caller-supplied email
Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality
CVE-2026-34225
### Summary There is a blind server side request forgery in the functionality that allows editing an image via a prompt.
Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
CVE-2026-26193
### Summary Manually modifying chat history allows setting the `embeds` property on a response message, the content of w
Open WebUI vulnerable to Stored XSS via iFrame in citations model
CVE-2026-26192
### Summary Manually modifying chat history allows setting the `html` property within document metadata. This causes the
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
CVE-2025-46719
### Summary A vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaS
Open WebUI allows limited stored XSS vila uploaded html file
CVE-2025-46571
### Summary Low privileged users can upload HTML files which contain JavaScript code via the `/api/v1/files/` backend en
Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
CVE-2026-55630
## Summary In Kiwi TCMS the fields `TestCase.extra_link` and `TestPlan.extra_link` were meant to represent URLs to exte
Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint
CVE-2026-54724
### Summary An open redirect vulnerability in the account confirmation endpoint allows an unauthenticated attacker to c
Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-...
CVE-2026-55615
Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type al
Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command
CVE-2026-55426
### Summary When a check plugin places user provided input inside a command which is passed to `shell_exec`, an attacker
Langroid: handle_message() executes user-supplied tool JSON without sender verification
CVE-2026-54771
## Summary A Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw
Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent
CVE-2026-54769
### Advisory Details **Title**: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatA
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
CVE-2026-54760
# SQLChatAgent `_validate_query` dangerous-pattern regex is bypassable via quoted/commented/qualified function names ##
Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases
CVE-2026-53759
### Summary The SQLite databases are created at predictable (static) paths in `/tmp`. Any user can therefore create a sy
Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB
CVE-2026-49360
### Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulner
Kiwi TCMS's /init-db/ page renders and responds to requests after first use
CVE-2026-49292
Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of
fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
CVE-2026-52830
## Summary fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The