Dernières vulnérabilités

CakePHP Authentication: Open redirect weakness via backslash bypass

Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

Deno: Denial of service via non-ASCII bytes in WebSocket response headers

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

handlebars.java FileTemplateLoader Path Traversal

Filament: Disabled RichEditor field state can be used for XSS

LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

Multer vulnerable to Denial of Service via deeply nested field names

Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

Gitea: Open Redirect via redirect_to

Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer

Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration

Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal

OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin

Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}

Open WebUI: Stored XSS to Account Takeover via Model Profile Images

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

Open WebUI: Stored XSS in Mermaid Markdown Preview

Open WebUI: Forged chat-file link allows cross-user file read and deletion

Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)

Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar