FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability...

CVE-2026-66040

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and A

历史摘要 · 未重新核验 · GitHub Advisory

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability...

CVE-2026-66036

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

### Summary **This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p (PostgreSQL SQL injection

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

## Summary Budibase's MongoDB query execution endpoint (`POST /api/v2/queries/:queryId`) is vulnerable to NoSQL injecti

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

#### Summary The Budibase Worker service exposes a public, unauthenticated API endpoint (`GET /api/global/users/tenant/:

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution

## Impact A builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs

## Impact In Budibase v3.39.4, a regression in the authorization level for the S3 attachment upload endpoint allows any

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile

## Summary When creating a MongoDB datasource, Budibase passes the `tlsCertificateKeyFile` and `tlsCAFile` fields straig

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)

## Summary `POST /api/v2/email` on the account portal (`account.budibase.app`) starts an email-change workflow using a

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Privilege escalation via public role assignment API missing app-level authorization

### Summary Budibase `3.39.19` (commit `03fbabae4`) is affected by a privilege-escalation / missing-authorization flaw

历史摘要 · 未重新核验 · GitHub Advisory

react-server-dom: Denial of Service in Server Functions

CVE-2026-44907

### Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server fu

历史摘要 · 未重新核验 · GitHub Advisory

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

CVE-2026-59221

AI assistance was used to help inspect the code and prepare this report. ## Summary The fix for GHSA-r2wg-2mcr-66rv is

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

CVE-2026-59224

## Summary The terminal proxy in `backend/open_webui/routers/terminals.py` forwards the Open WebUI user's identity to t

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

CVE-2026-55502

## Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer

历史摘要 · 未重新核验 · GitHub Advisory

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

CVE-2026-55404

### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may pro

历史摘要 · 未重新核验 · GitHub Advisory

Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate...

CVE-2026-56167

Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network

历史摘要 · 未重新核验 · GitHub Advisory

Improper access control in Azure API Management (APIM) allows an authorized attacker to execute...

CVE-2026-35425

Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.

历史摘要 · 未重新核验 · GitHub Advisory

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass...

CVE-2026-65604

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) d

历史摘要 · 未重新核验 · GitHub Advisory

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file...

CVE-2026-65694

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthen

历史摘要 · 未重新核验 · GitHub Advisory

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password...

CVE-2026-40430

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cl

历史摘要 · 未重新核验 · GitHub Advisory