Rezultati pretraživanja za 'Od datuma: 16.01.2025.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-109288 | 6.4 | Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in share | 2026-10-12 17:17:21 | 2026-10-12 17:17:21 |
| CVE-2026-109287 | 4.3 | Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a r | 2026-10-12 17:17:21 | 2026-10-12 17:17:21 |
| CVE-2026-109286 | 8.1 | Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-tr | 2026-10-12 17:17:21 | 2026-10-12 17:17:21 |
| CVE-2026-109285 | 5.0 | Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants | 2026-10-12 17:17:21 | 2026-10-12 17:17:21 |
| CVE-2026-109284 | 4.3 | Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only | 2026-10-12 17:17:21 | 2026-10-12 17:17:21 |
| CVE-2026-109283 | 5.4 | Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring r | 2026-10-12 17:17:21 | 2026-10-12 17:17:21 |
| CVE-2026-109282 | 2.5 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who c | 2026-10-12 17:17:21 | 2026-10-12 17:17:21 |
| CVE-2026-109281 | 4.4 | ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx exp | 2026-10-12 17:17:20 | 2026-10-12 17:17:20 |
| CVE-2026-109280 | 2.5 | ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger | 2026-10-12 17:17:20 | 2026-10-12 17:17:20 |
| CVE-2026-109279 | 2.5 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer over-write. | 2026-10-12 17:17:20 | 2026-10-12 17:17:20 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/11792
Zapisa po stranici: