High
CVE-2026-59216
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,359
Reset filters
Medium
CVE-2026-59217
Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
Medium
CVE-2026-59227
Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
Medium
CVE-2026-59220
Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
Low
CVE-2026-59715
Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)
High
CVE-2026-59219
Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
Low
CVE-2026-59213
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
Medium
CVE-2026-13769
AWS CLI: Overly permissive File Permissions
Medium
CVE-2026-61632
PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
High
CVE-2026-59214
Open WebUI: Stored web worker XSS via Pyodide
Medium
CVE-2026-59218
Open WebUI: Account enumeration via observable login timing discrepancy
Low
CVE-2026-63632
ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape
Medium
CVE-2026-49138
Nanobot contains a server-side request forgery vulnerability in the web_fetch tool
Low
CVE-2026-11466
zilliztech deep-searcher has an Incorrect Privilege Assignment issue
Medium
CVE-2026-10221
hermes-agent has an Injection issue
Low
CVE-2026-10223
hermes-agent has an Injection issue
High
CVE-2026-69097
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
High
CVE-2026-67326
GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
Medium
ghsa-wchh-9x6h-7f6p
olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193
High
CVE-2026-54609
QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
High
CVE-2025-71408
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arb
Low
ghsa-464c-974j-9xm6
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion
Medium
CVE-2026-66004
BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes
Medium
CVE-2026-66007
Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being join
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.