Open WebUI has an Indirect Object Reference (IDOR) in user notes
CVE-2026-45666
### Summary The API /api/v1/notes/{note_id} endpoint lacks proper authorization checks, allowing authenticated users to
#severity:medium
共收录 5624 条相关情报。
← 返回所有主题Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure
CVE-2026-45397
**Vulnerability Type:** Information Disclosure / Missing Authentication **Severity:** Medium **Component:** `backend
In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in...
CVE-2026-44919
In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can oc
Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of...
CVE-2026-41281
Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CW
Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System...
CVE-2026-45228
Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While...
CVE-2026-8328
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to rep
A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables...
CVE-2026-0243
A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attac
A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously...
CVE-2026-8496
A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar in
When a user's access to mint tokens for a service account is revoked, it is sometimes still...
CVE-2026-33381
When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few
Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a...
CVE-2026-33378
Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the s
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from...
CVE-2026-33380
A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's fi
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a...
CVE-2026-28376
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming req
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by...
CVE-2026-28383
A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request b
Editors could delete any annotation, even those they do not have read access to. The editor user...
CVE-2026-28374
Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read t
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server...
CVE-2026-28379
A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concur
Any Editor could delete any snapshot, even if they have no access to read or write them.
CVE-2026-28380
Any Editor could delete any snapshot, even if they have no access to read or write them.
A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto...
CVE-2026-0258
A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software al
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables...
CVE-2026-0256
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticat
A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables...
CVE-2026-0250
A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle att
A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access...
CVE-2026-0246
A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally a