A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c...

CVE-2026-12528

A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Acce

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.

CVE-2026-52716

Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.

历史摘要 · 未重新核验 · GitHub Advisory

Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

CVE-2026-55636

### Summary Capsule v0.13.2 webhook rules contain `namespace/finalize` (singular) instead of `namespaces/finalize` (plur

历史摘要 · 未重新核验 · GitHub Advisory

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

CVE-2026-9595

### Impact When a user-configured proxy on `webpack-dev-server` has a broad context (e.g. `/`) and `ws: true`, it also

历史摘要 · 未重新核验 · GitHub Advisory

Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

CVE-2026-5038

### Impact A vulnerability in Multer allows an attacker to trigger a Denial of Service (DoS) by aborting or sending mal

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Open Redirect via redirect_to

CVE-2026-25779

### Details Despite the validation within `urlIsRelative` in `modules/httplib/url.go`, an open redirect is still possib

历史摘要 · 未重新核验 · GitHub Advisory

Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join

CVE-2026-54324

### Summary A cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user

历史摘要 · 未重新核验 · GitHub Advisory

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

CVE-2026-54316

Because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—i

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

CVE-2026-54022

### Summary The `ydoc:document:join` Socket.IO handler checks note ownership only when the `document_id` starts with `n

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

CVE-2026-54021

## Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied `url_idx` path parameter and us

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

CVE-2026-54019

# RAG ACL Bypass in Milvus Multitenancy Mode ## Summary This is a bypass of the fix for: - GHSA-h36f-rqpx-j5wx - CVE-

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

CVE-2026-54016

## Summary Open WebUI has a Broken Object Level Authorization (BOLA) vulnerability in the builtin `search_knowledge_fil

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

CVE-2026-54015

## Summary Open WebUI's prompt version-history endpoints authorize the `prompt_id` in the URL but then act on caller-su

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}

CVE-2026-54014

## Summary A path traversal vulnerability exists in open-webui's cache file serving endpoint that allows any authentica

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Token scope bypass on web archive download endpoint

CVE-2026-20706

## Summary PR #37698 added checkDownloadTokenScope to /raw/*, /media/*, and attachment download web endpoints. The /arc

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Missing repository-unit authorization on issue-template API endpoints

CVE-2026-27783

## Summary Three Gitea API endpoints — `GET /repos/{owner}/{repo}/issue_templates`, `GET /repos/{owner}/{repo}/issue_co

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw

CVE-2026-25714

## Summary Two related issues in the token public-only scope enforcement introduced by PR #32204 (CVE-2025-68941 fix).

历史摘要 · 未重新核验 · GitHub Advisory

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-p...

CVE-2026-49993

### Summary This is an incomplete fix for [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Denial of Service via ZIP decompression in webhook workflow

CVE-2026-54314

## Impact The Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcin

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Public API Execution Retry Authorization Bypass

## Impact The Public API endpoint for retrying executions authorized access using `workflow:read` rather than `workflow:

历史摘要 · 未重新核验 · GitHub Advisory