eml_parser has recursion DoS via nested message/rfc822 attachments
CVE-2026-44844
### Summary `EmlParser.get_raw_body_text()` recurses unconditionally for every nested `message/rfc822` attachment witho
#pip
共收录 834 条相关情报。
← 返回所有主题LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
CVE-2026-44843
LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled pa
Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
CVE-2026-44566
# **CONFIDENTIAL** # KL-CAN-2024-002 ## Vulnerability Details | # | Field | Value | |---|-------|-------| | 1 | **Dis
Open WebUI has Improper Authorization Control
CVE-2026-44567
# **CONFIDENTIAL** # Vulnerability Disclosure Analysis Documentation --- ## Vulnerability Details | # | Field | Valu
Open WebUI has stored XSS in Excel file preview
CVE-2026-44549
### Summary Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the
Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order
CVE-2026-44568
## Vulnerability Details **CWE-79**: Cross-site Scripting (XSS) The `AccountPending.svelte` component renders the admi
banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI
CVE-2026-44209
## Summary `banks /tmp/rce_banks_exec').read() }}") p.text() ``` ```bash ls -l /tmp/rce_banks_exec # -rw-rw-r-- 1 ak a
Wagtail has improper permission handling when copying pages
CVE-2026-44200
### Impact A CMS user with limited access to pages could copy a page they don't have access to to an area of the site t
Wagtail has improper restriction handling on Documents and Images API
CVE-2026-44201
### Impact The Documents and Images [API](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectl
Wagtail has improper permission handling when deleting form submissions
CVE-2026-44199
### Impact A CMS user with limited access to form pages could delete submissions to form pages they don't have access t
Wagtail has improper permission handling when viewing page history
CVE-2026-44198
### Impact A CMS user without the ability to edit a page could still access the history report for the page, potentiall
Wagtail has improper permission handling when comparing revisions
CVE-2026-44197
### Impact A CMS user without the ability to edit a page could access revisions of the page through the revision compar
Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search
CVE-2026-44560
# Unauthorized File and Knowledge Base Content Access via RAG Vector Search ## Affected Component RAG source resolutio
Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels
CVE-2026-44561
# Deactivated Channel Members Retain Full Access to Group/DM Channels ## Affected Component Channel membership authori
Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO
CVE-2026-44564
# Read-Only Users Can Modify Collaborative Documents via Socket.IO ## Affected Component Socket.IO collaborative docum
Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show
CVE-2026-44563
# Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show ## Affected Componen
Open WebUI's Model Import Overwrites Any Model Without Ownership Check
CVE-2026-44562
# Model Import Overwrites Any Model Without Ownership Check ## Affected Component Model import endpoint: - `backend/op
Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels
CVE-2026-44559
# Missing Access Check on Channel Members Endpoint for Standard Channels ## Affected Component Channel members listing
Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection
CVE-2026-44557
# Global Knowledge Base Enumeration via knowledge-bases Meta-Collection ## Affected Component Retrieval collection acc
Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
CVE-2026-44554
# Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite ## Affected Component Retrieval w