Browse CVEs

MEDIUM 5.0 CVE-2026-18816 A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file backend/src/baserow/api/two_… No fix yet Fix from $1,6002026-08-04 HIGH 7.2 CVE-2026-18814 A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in com… No fix yet Fix from $1,9502026-08-04 MEDIUM 5.0 CVE-2026-70588 Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize impor… Patch available Fix from $1,6002026-08-04 CRITICAL 9.8 CVE-2026-70554 MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-control… No fix yet Fix from $2,3002026-08-04 HIGH 8.1 CVE-2026-70494 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handl… Patch available Fix from $1,9502026-08-04 MEDIUM 6.5 CVE-2026-70493 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in … Patch available Fix from $1,6002026-08-04 HIGH 8.7 CVE-2026-70492 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Mark… Patch available Fix from $1,9502026-08-04 MEDIUM 6.5 CVE-2026-70491 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tool… Patch available Fix from $1,6002026-08-04 CRITICAL 9.1 CVE-2026-67979 Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary … Mitigation only Fix from $2,3002026-08-04 CRITICAL 9.8 CVE-2026-66902 Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The Pluggable sub… Patch available Fix from $2,3002026-08-04 HIGH 7.5 CVE-2026-66901 Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credenti… Patch available Fix from $1,9502026-08-04 MEDIUM 6.3 CVE-2026-70490 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backen… No fix yet Fix from $1,6002026-08-04 MEDIUM 6.5 CVE-2026-70489 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backe… Patch available Fix from $1,6002026-08-04 MEDIUM 5.3 CVE-2026-70487 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted … Patch available Fix from $1,6002026-08-04 HIGH 7.7 CVE-2026-51401 An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/sr… No fix yet Fix from $1,9502026-08-04 HIGH 8.4 CVE-2026-51400 An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/sr… No fix yet Fix from $1,9502026-08-04 HIGH 8.5 CVE-2026-65986 CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability tha… Patch available Fix from $1,9502026-08-04 MEDIUM 6.3 CVE-2026-54020 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL vali… No fix yet Fix from $1,6002026-08-04 CRITICAL 9.8 CVE-2026-45538 OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longe… No fix yet Fix from $2,3002026-08-04 HIGH 7.2 CVE-2026-18813 A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.ap… No fix yet Fix from $1,9502026-08-04 HIGH 7.2 CVE-2026-18812 A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the… No fix yet Fix from $1,9502026-08-04 HIGH 7.2 CVE-2026-18811 A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the a… No fix yet Fix from $1,9502026-08-04 HIGH 7.1 CVE-2026-13227 An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API … No fix yet Fix from $1,9502026-08-04 CRITICAL 9.8 CVE-2026-70553 MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application co… No fix yet Fix from $2,3002026-08-04 CRITICAL 9.8 CVE-2026-70552 MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access … No fix yet Fix from $2,3002026-08-04 HIGH 8.2 CVE-2026-70486 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl ifr… Patch available Fix from $1,9502026-08-04 HIGH 7.1 CVE-2026-70485 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supp… Patch available Fix from $1,9502026-08-04 HIGH 8.1 CVE-2026-70482 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLE_OAUTH_TOKEN_EXCHANGE=True,… Patch available Fix from $1,9502026-08-04 MEDIUM 5.4 CVE-2026-70481 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update an… Patch available Fix from $1,6002026-08-04 HIGH 7.7 CVE-2026-70479 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEB_LOADER_ENGINE=playwright, the… Patch available Fix from $1,9502026-08-04