Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
CVE-2026-59212
## Summary Current `main` and `v0.9.6` still allow an authenticated user to turn read-only access to another user's fil
#severity:medium
共收录 5514 条相关情报。
← 返回所有主题Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
CVE-2026-59223
## Summary The administrator-configured `WEB_FETCH_FILTER_LIST` (the allow/block list applied to server-side web fetche
webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
CVE-2026-57497
## Summary An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport caps
Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings
CVE-2026-55499
## Summary When an authenticated recipient of a **single-file** share opens the file event stream (`GET /api/v4/file/e
Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server
CVE-2026-55497
## Summary Cloudreve's built-in image processor decodes user-supplied images with Go's standard-library decoders (`imag
Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails
CVE-2026-55496
## Summary `GET /api/v4/user/search` is available to any logged-in user. The service calls `userClient.SearchActive`,
Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account
CVE-2026-55495
## Summary Cloudreve's WOPI `PUT_RELATIVE` handler treats `X-WOPI-SuggestedTarget` as a path, not a filename. It split
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an...
CVE-2026-49159
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information...
CVE-2026-44955
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized contr
A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile:...
CVE-2026-16767
A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file sr
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some...
CVE-2026-16765
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality o
An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process...
CVE-2026-12353
An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly se
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in...
CVE-2026-65010
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that a
c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets
CVE-2026-55223
### Impact The JDBC spec defines the interface `DataSource`, with a method called `getConnection()`, and `ConnectionPoo
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
CVE-2026-53669
This is a follow up to [CVE-2025-68470](https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4
React Router: Open redirect leading to XSS
CVE-2026-53668
Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external locat
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
CVE-2026-53667
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
CVE-2026-53666
If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, the
ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
CVE-2026-53467
In the MNG decoder there is a possible heap information disclosure because part of the pixels are left unchanged.
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 1.0.0-6.0.9 - Improper...
CVE-2026-65763
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 1.0.0-6.0.9 - Improper validation of user inputs