Permalink CVE-2026-47828

8.9 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay

• https://www.cloudfoundry.org/blog/cve-2026-47828-missing-tls-certificate-verifi…

---

bosh-cli

• <7.10.4

Permalink CVE-2026-47829

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director

• https://www.cloudfoundry.org/blog/cve-2026-47829-argument-injection-in-bosh-cli…

---

bosh-cli

• <7.10.4

Permalink CVE-2026-55689

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  3 packages

  • openfga-cli
  • python313Packages.openfga-sdk
  • python314Packages.openfga-sdk
  an hour ago
• @LeSuisse ignored
  2 references

  • https://github.com/openfga/helm-ch
  • https://github.com/openfga/helm-charts/…
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

• https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv x_refsource_CONFIRM
• https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271 x_refsource_MISC
• https://github.com/openfga/openfga/releases/tag/v1.18.0 x_refsource_MISC

Ignored references (2)

• https://github.com/openfga/helm-ch x_refsource_MISC
• https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9 x_refsource_MISC

---

openfga

• ==< 1.18.0

Needs some backports to stable

Permalink CVE-2026-55170

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  3 packages

  • openfga-cli
  • python313Packages.openfga-sdk
  • python314Packages.openfga-sdk
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

• https://github.com/openfga/openfga/security/advisories/GHSA-cf98-j28v-49v6 x_refsource_CONFIRM
• https://github.com/openfga/helm-charts/commit/96d5517a2693ff5def451dee7d6b9d1baeb281f8 x_refsource_MISC
• https://github.com/openfga/openfga/commit/a2e0dbefc3e01a95c785f81a3563bc6571b08b11 x_refsource_MISC
• https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9 x_refsource_MISC
• https://github.com/openfga/openfga/releases/tag/v1.18.0 x_refsource_MISC

---

openfga

• ==< 1.18.0

Needs some backports to stable

Permalink CVE-2026-59721

7.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-v7q6-r45w-2c6r exploitx_refsource_CONFIRM
• https://github.com/hoppscotch/hoppscotch/pull/6413 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/commit/73a88c82b1b2cada26cc4b2bc095b54554242239 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0 x_refsource_MISC

---

hoppscotch

• ==< 2026.6.0

Permalink CVE-2026-59720

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server

• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-c68f-wr5p-j6jf exploitx_refsource_CONFIRM
• https://github.com/hoppscotch/hoppscotch/pull/6410 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/commit/e4332110d455a3012d5c77a9186bc4aa096e34f2 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0 x_refsource_MISC

---

hoppscotch

• ==< 2026.6.0

Permalink CVE-2026-59220

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

• https://github.com/open-webui/open-webui/security/advisories/GHSA-ffpj-xv5c-p3gw exploitx_refsource_CONFIRM
• https://github.com/open-webui/open-webui/commit/61a26722155ec6ee1b629cf8dfcf975098c18331 x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==>= 0.9.2, < 0.10.0

Permalink CVE-2026-59218

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Account enumeration via observable login timing discrepancy

• https://github.com/open-webui/open-webui/security/advisories/GHSA-7rw5-9f7q-xj36 x_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/26385 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/993e74912199c66c522f08ec81abe31d76985e39 x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==< 0.10.0

Permalink CVE-2026-59212

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

• https://github.com/open-webui/open-webui/security/advisories/GHSA-2xwm-4h2q-ggfx x_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/26032 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/17df0264929514599dbcb21c6578bcdfa204b04d x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==>= 0.9.6, < 0.10.0

Permalink CVE-2026-59226

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

• https://github.com/open-webui/open-webui/security/advisories/GHSA-mvx4-532p-xfm9 x_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/26047 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/920b655f4689e2118de928fbc936f6ebd4fed396 x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==>= 0.9.0, < 0.10.0

Permalink CVE-2026-59225

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Arena task endpoints can bypass underlying model access controls

• https://github.com/open-webui/open-webui/security/advisories/GHSA-m3qf-58wf-w979 x_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/26046 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/dc4924b66e655b315e3be4430a3e51b7d5c20acc x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==>= 0.8.12, < 0.10.0

Permalink CVE-2026-59221

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

• https://github.com/open-webui/open-webui/security/advisories/GHSA-frvj-c5qp-xj4w exploitx_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/26050 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/05098d25a58d03738e01c4e85e8852c3b4ad849c x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==>= 0.9.6, < 0.10.0

Permalink CVE-2026-59222

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

• https://github.com/open-webui/open-webui/security/advisories/GHSA-gh7p-78x6-jw6m exploitx_refsource_CONFIRM
• https://github.com/open-webui/open-webui/commit/fbcdcf146b99b5002705060a8243eee769108f9e x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==>= 0.7.0, < 0.10.0

Permalink CVE-2026-59227

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

• https://github.com/open-webui/open-webui/security/advisories/GHSA-rqj7-6wrp-6g2g x_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/26009 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/e038bab66dec8d17212eec35b5cb6d6b785a4200 x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==>= 0.8.11, < 0.10.0

Permalink CVE-2026-59223

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

• https://github.com/open-webui/open-webui/security/advisories/GHSA-qg3f-8x3j-ggf2 x_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/25949 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/087878ce848a4d828012068b5997dac480f43656 x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==< 0.10.0

Permalink CVE-2026-59213

3.5 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

• https://github.com/open-webui/open-webui/security/advisories/GHSA-3wp3-xxj9-5jqq exploitx_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/25783 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/0fc630b34b2899599dabffffa012afd47599aa75 x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==>= 0.6.27, < 0.10.0

Permalink CVE-2026-59715

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

• https://github.com/open-webui/open-webui/security/advisories/GHSA-gmfw-g93r-vg53 exploitx_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/25946 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/22f2fe1ffb66c993dad1e0b2b35514acaed2370e x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==>= 0.6.16, < 0.10.0

Permalink CVE-2026-59224

8.0 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

• https://github.com/open-webui/open-webui/security/advisories/GHSA-j657-m4c4-24jq x_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/26042 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/5f3a628a8d291bb5d33e1a0b0c89fb62a2927934 x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==< 0.10.0

Permalink CVE-2026-59217

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

• https://github.com/open-webui/open-webui/security/advisories/GHSA-7r7x-gjvr-448g x_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/26001 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/b7626f05fb92b24ab923ad81a037071ebd5623d1 x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==< 0.10.0

Permalink CVE-2026-59215

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

• https://github.com/open-webui/open-webui/security/advisories/GHSA-73x5-h92w-xc2j exploitx_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/25766 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/a66477b7104c5d141ce7bffaea424b43e7666ef1 x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==< 0.10.0

Permalink CVE-2026-59214

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Stored web worker XSS via Pyodide

• https://github.com/open-webui/open-webui/security/advisories/GHSA-4r2p-27mh-5m22 x_refsource_CONFIRM

---

open-webui

• ==< 0.10.0

Permalink CVE-2026-59219

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

• https://github.com/open-webui/open-webui/security/advisories/GHSA-855v-hq7w-jmjw exploitx_refsource_CONFIRM
• https://github.com/open-webui/open-webui/commit/33b91bd8ae8a100a5a306c91441a7d0b422c4cde x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==>= 0.9.0, < 0.10.0

Permalink CVE-2026-59216

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

• https://github.com/open-webui/open-webui/security/advisories/GHSA-74h3-cxq7-vc5q exploitx_refsource_CONFIRM
• https://github.com/open-webui/open-webui/pull/25763 x_refsource_MISC
• https://github.com/open-webui/open-webui/commit/386ac958144dbbbf0aa6e268070d72b681a318aa x_refsource_MISC
• https://github.com/open-webui/open-webui/releases/tag/v0.10.0 x_refsource_MISC

---

open-webui

• ==< 0.10.0

Permalink CVE-2026-15182

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 references

  • https://www.gnu.org/
  • Submit #851191 | LibreDWG 0.13.4-154-g0…
  • CVE-2026-15182 | CVE Analysis and Report
  • VDB-377109 | CTI Indicators (IOB, IOC, …
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow

• VDB-377109 | GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow vdb-entrytechnical-description
• https://github.com/LibreDWG/libredwg/issues/1252 exploitissue-tracking
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_0b57303_heap… exploit
• https://github.com/LibreDWG/libredwg/commit/18fd542bb4d5ccedf9de12052bf50068b2b… patch
• https://github.com/LibreDWG/libredwg/releases/tag/0.14 patch
• https://github.com/LibreDWG/libredwg/issues/1249 exploitissue-tracking

Ignored references (4)

• https://www.gnu.org/ productbroken-link
• Submit #851191 | LibreDWG 0.13.4-154-g0b573035 (main branch, commit 0b573035, 2026-04-29) 内存损坏 (Heap Buffer Overflow - Read) exploitthird-party-advisory
• CVE-2026-15182 | CVE Analysis and Report third-party-advisory
• VDB-377109 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature

---

LibreDWG

• ==0.13.0
• ==0.14
• ==0.13.4
• ==0.13.1
• ==0.13.3
• ==0.13.2

Permalink CVE-2026-15184

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 references

  • https://www.gnu.org/
  • Submit #851192 | LibreDWG 0.13.4-154-g0…
  • CVE-2026-15184 | CVE Analysis and Report
  • VDB-377110 | CTI Indicators (IOB, IOC, …
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference

• VDB-377110 | GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference vdb-entrytechnical-description
• https://github.com/LibreDWG/libredwg/issues/1253 issue-tracking
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_0b57303_dwgg… exploit
• https://github.com/LibreDWG/libredwg/commit/dde45dac3c4d902e4d8fed150a8017b9732… patch
• https://github.com/LibreDWG/libredwg/releases/tag/0.14 patch

Ignored references (4)

• https://www.gnu.org/ productbroken-link
• Submit #851192 | LibreDWG 0.13.4-154-g0b573035 (main branch, commit 0b573035, 2026-04-29) 空指针解引用 (NULL Pointer Dereference) third-party-advisory
• CVE-2026-15184 | CVE Analysis and Report third-party-advisory
• VDB-377110 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature

---

LibreDWG

• ==0.13.0
• ==0.14
• ==0.13.4
• ==0.13.1
• ==0.13.3
• ==0.13.2

Permalink CVE-2026-59828

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 packages

  • discourse-mail-receiver
  • python313Packages.pydiscourse
  • python314Packages.pydiscourse
  • grafanaPlugins.grafana-discourse-datasource
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Discourse: Hidden post revisions leak through adjacent visible diffs

• https://github.com/discourse/discourse/security/advisories/GHSA-q456-4f8q-42vx x_refsource_CONFIRM
• https://github.com/discourse/discourse/commit/1f26c1163ce87a2abbd1d01780ab1b5fb16e75f6 x_refsource_MISC
• https://github.com/discourse/discourse/commit/8b773332b0f937dfcd894ed56d56fc5a81578d9d x_refsource_MISC
• https://github.com/discourse/discourse/commit/8d36da1b68c906592abde3f2e94d505cdf097435 x_refsource_MISC
• https://github.com/discourse/discourse/commit/d58988d46bb1019bfa8b8330ae81a1a134e08511 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.5
• ==>= 2026.4.0-latest, < 2026.4.2
• ==>= 2026.5.0-latest, < 2026.5.1

Permalink CVE-2026-44787

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 packages

  • python313Packages.pydiscourse
  • python314Packages.pydiscourse
  • grafanaPlugins.grafana-discourse-datasource
  • discourse-mail-receiver
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Discourse: Signup-time primary_group_id assignment grants whisperer access

• https://github.com/discourse/discourse/security/advisories/GHSA-vmwq-jvxx-jwfx x_refsource_CONFIRM
• https://github.com/discourse/discourse/commit/012796ac28c85b30aa233c5ef042fc66efff8126 x_refsource_MISC
• https://github.com/discourse/discourse/commit/0f50a07a6ef4b33f3f826ce6d7bf6d7bd16912d8 x_refsource_MISC
• https://github.com/discourse/discourse/commit/5418e3027dba109e27a4796463686d61e190ac29 x_refsource_MISC
• https://github.com/discourse/discourse/commit/6fc7e6cf04422fc3f9d1c99134803071e983ff0a x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.5
• ==>= 2026.4.0-latest, < 2026.4.2
• ==>= 2026.5.0-latest, < 2026.5.1

Permalink CVE-2026-53963

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 packages

  • discourse-mail-receiver
  • python313Packages.pydiscourse
  • python314Packages.pydiscourse
  • grafanaPlugins.grafana-discourse-datasource
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Discourse: Stored-XSS in 2FA delete confirmation modal

• https://github.com/discourse/discourse/security/advisories/GHSA-wg5x-7f23-m3r5 x_refsource_CONFIRM
• https://github.com/discourse/discourse/commit/40de62cddadc65c328a1028ab999f3fa94adbfed x_refsource_MISC
• https://github.com/discourse/discourse/commit/529e17d4d570a48972e7cf64720e5dd1fdf23ca8 x_refsource_MISC
• https://github.com/discourse/discourse/commit/d92973e51a46cf6dd20c71e6068e6769b67eea5b x_refsource_MISC
• https://github.com/discourse/discourse/commit/daea5214d833eacbdd3b1a78d99eb14e9cabd915 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.5
• ==>= 2026.4.0-latest, < 2026.4.2
• ==>= 2026.5.0-latest, < 2026.5.1

Permalink CVE-2026-53961

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 packages

  • discourse-mail-receiver
  • python313Packages.pydiscourse
  • python314Packages.pydiscourse
  • grafanaPlugins.grafana-discourse-datasource
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)

• https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x x_refsource_CONFIRM
• https://github.com/discourse/discourse/commit/3a3d315a85ef3c6aabfc7e7bb38702059784f06b x_refsource_MISC
• https://github.com/discourse/discourse/commit/61f12e13aa1b760f81d5ff60f12e3a7e77434b94 x_refsource_MISC
• https://github.com/discourse/discourse/commit/958f0cd831d65a49ec75f05343ca2c167679f0ea x_refsource_MISC
• https://github.com/discourse/discourse/commit/aea35190791261bab258ebab05da279e78cdd0e6 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.5
• ==>= 2026.4.0-latest, < 2026.4.2
• ==>= 2026.5.0-latest, < 2026.5.1

Permalink CVE-2026-45780

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 packages

  • discourse-mail-receiver
  • python313Packages.pydiscourse
  • python314Packages.pydiscourse
  • grafanaPlugins.grafana-discourse-datasource
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Discourse: Private event sample invitees are serialized to non-invited event viewers

• https://github.com/discourse/discourse/security/advisories/GHSA-22v7-6wgj-g9f7 x_refsource_CONFIRM
• https://github.com/discourse/discourse/commit/37969503f20369eb1712b7b88daedcfb4f63f5f1 x_refsource_MISC
• https://github.com/discourse/discourse/commit/4d46638041b5f3d1e1f7f6f6f19c1df3bd65a586 x_refsource_MISC
• https://github.com/discourse/discourse/commit/6457ab71f36a2d1440fe96af0a2593897844b023 x_refsource_MISC
• https://github.com/discourse/discourse/commit/7deb4b6963442569357b41e61febe37594e5e730 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.5
• ==>= 2026.4.0-latest, < 2026.4.2
• ==>= 2026.5.0-latest, < 2026.5.1

Permalink CVE-2026-55420

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 packages

  • discourse-mail-receiver
  • python313Packages.pydiscourse
  • python314Packages.pydiscourse
  • grafanaPlugins.grafana-discourse-datasource
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Discourse: Remote code execution via pdf uploads

• https://github.com/discourse/discourse/security/advisories/GHSA-7wq5-jgww-5rw3 x_refsource_CONFIRM
• https://github.com/discourse/discourse/commit/ca5a7e06167561928556afa2f237d67e459c6914 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.5
• ==>= 2026.4.0-latest, < 2026.4.2
• ==>= 2026.5.0-latest, < 2026.5.1

Permalink CVE-2026-45788

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 packages

  • discourse-mail-receiver
  • python313Packages.pydiscourse
  • python314Packages.pydiscourse
  • grafanaPlugins.grafana-discourse-datasource
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Discourse: Secure uploads exposed by hotlinked image copying

• https://github.com/discourse/discourse/security/advisories/GHSA-3876-w96v-8v38 x_refsource_CONFIRM
• https://github.com/discourse/discourse/commit/5807c426880eadf248006e851604fc9284327ce5 x_refsource_MISC
• https://github.com/discourse/discourse/commit/8b4a959b251a856a9c911fb9f2ac34fbc31a7471 x_refsource_MISC
• https://github.com/discourse/discourse/commit/eff53af26367ae0dcb3a426954d233e8c7449f95 x_refsource_MISC
• https://github.com/discourse/discourse/commit/fa74e0dec7341a858ab83a1977fa52629bced1aa x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.5
• ==>= 2026.4.0-latest, < 2026.4.2
• ==>= 2026.5.0-latest, < 2026.5.1

Permalink CVE-2026-46413

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 packages

  • discourse-mail-receiver
  • python313Packages.pydiscourse
  • python314Packages.pydiscourse
  • grafanaPlugins.grafana-discourse-datasource
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Discourse: Regular users can route multipart uploads into the admin backup store

• https://github.com/discourse/discourse/security/advisories/GHSA-3mvf-q9rg-w6m7 x_refsource_CONFIRM
• https://github.com/discourse/discourse/commit/1f1ded8dd361d81786bff17b35e1138d6ee299c0 x_refsource_MISC
• https://github.com/discourse/discourse/commit/7ddde266617b452152c1bf5f903f6c07be38fc40 x_refsource_MISC
• https://github.com/discourse/discourse/commit/a53df26dcf7e50ce2b20bfd5454a0c9d44b8fc7d x_refsource_MISC
• https://github.com/discourse/discourse/commit/abaa664c5df84026efb2ca264ba0f5586c3f2b01 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.5
• ==>= 2026.4.0-latest, < 2026.4.2
• ==>= 2026.5.0-latest, < 2026.5.1

Permalink CVE-2026-49256

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 packages

  • discourse-mail-receiver
  • python313Packages.pydiscourse
  • python314Packages.pydiscourse
  • grafanaPlugins.grafana-discourse-datasource
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Discourse: Hidden tag names leaked via category serializers

• https://github.com/discourse/discourse/security/advisories/GHSA-mwp7-572g-6qpx x_refsource_CONFIRM
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.5
• ==>= 2026.4.0-latest, < 2026.4.2
• ==>= 2026.5.0-latest, < 2026.5.1

Permalink CVE-2026-53962

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 packages

  • discourse-mail-receiver
  • python313Packages.pydiscourse
  • python314Packages.pydiscourse
  • grafanaPlugins.grafana-discourse-datasource
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Discourse: Insufficient SVG sanitization logic

• https://github.com/discourse/discourse/security/advisories/GHSA-jmcf-3367-78vv x_refsource_CONFIRM
• https://github.com/discourse/discourse/commit/3ee8343cd7f00d59d8513bee0a12e02d50bfc358 x_refsource_MISC
• https://github.com/discourse/discourse/commit/810c2715799fd08b06fd6ffc664d9562fe9ea6ff x_refsource_MISC
• https://github.com/discourse/discourse/commit/92a699d89b84685b6fdd63cd0d0e371793c69dad x_refsource_MISC
• https://github.com/discourse/discourse/commit/b8ceb49f4ba52257be30eb3c2ce51a5bf03be5fe x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.5
• ==>= 2026.4.0-latest, < 2026.4.2
• ==>= 2026.5.0-latest, < 2026.5.1

Permalink CVE-2026-55424

7.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse ignored
  4 packages

  • discourse-mail-receiver
  • python313Packages.pydiscourse
  • python314Packages.pydiscourse
  • grafanaPlugins.grafana-discourse-datasource
  an hour ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

Discourse: Topic featured link susceptible to stored XSS

• https://github.com/discourse/discourse/security/advisories/GHSA-695w-7fv8-mxg3 x_refsource_CONFIRM
• https://github.com/discourse/discourse/commit/1bce8881e4253d9bbab56f011a12ef899b926b59 x_refsource_MISC
• https://github.com/discourse/discourse/commit/6679d9a5083488bae10c2adbb345c481c583242c x_refsource_MISC
• https://github.com/discourse/discourse/commit/6828aee9b15c2655d63b515ac919830bd540ff83 x_refsource_MISC
• https://github.com/discourse/discourse/commit/c9b9405f5bd0bf0269e505e28e3aad388d7657c5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 x_refsource_MISC
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.5
• ==>= 2026.4.0-latest, < 2026.4.2
• ==>= 2026.5.0-latest, < 2026.5.1

Permalink CVE-2026-59832

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-275h-v5h9-vr82 x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/commit/68cc0f537dfa4502496dfa794e71835421c25c09 x_refsource_MISC
• https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1 x_refsource_MISC

---

siyuan

• ==< 3.7.1

Permalink CVE-2026-59855

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

SiYuan: Store XSS To Rce via Asset.render

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w3gq-5j72-36vc x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/commit/efbe3a557720034782643e55c9e0282530cb6bbb x_refsource_MISC
• https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1 x_refsource_MISC

---

siyuan

• ==< 3.7.1

Permalink CVE-2026-59833

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-97xv-3v84-h358 x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/commit/ebe252e61fb93f258d083b9da0fa403679fdf94a x_refsource_MISC
• https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1 x_refsource_MISC

---

siyuan

• ==< 3.7.1

Permalink CVE-2026-59853

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

SiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter)

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-px3c-cf92-9g83 x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/commit/0049d0f04ffe9837760d29248b9ef31605077d36 x_refsource_MISC
• https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1 x_refsource_MISC

---

siyuan

• ==< 3.7.1

Permalink CVE-2026-59854

4.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vmm8-3ccv-ppvw x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/commit/914c5180a88d17f6d38716a56483327b367ef55f x_refsource_MISC
• https://github.com/siyuan-note/siyuan/commit/b54fee401799d987d2fd2888220938ad599b8c5e x_refsource_MISC
• https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1 x_refsource_MISC

---

siyuan

• ==< 3.7.1

Permalink CVE-2026-59834

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated an hour ago by @LeSuisse Activity log

• Created suggestion 9 hours ago
• @LeSuisse accepted an hour ago
• @LeSuisse published on GitHub an hour ago

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h89q-4j2h-7h88 x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/commit/57bcad4b331836880bfe6be25d4180bdcf10db0d x_refsource_MISC
• https://github.com/siyuan-note/siyuan/commit/d0f0fe146fb07d594fcadc4f48d4f7c30ac01d1e x_refsource_MISC
• https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1 x_refsource_MISC

---

siyuan

• ==< 3.7.1

Permalink CVE-2026-58494

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 day, 3 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 9 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.wasmtime
  • python314Packages.wasmtime
  1 day, 3 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 3 hours ago

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj x_refsource_CONFIRM
• https://github.com/bytecodealliance/wasmtime/commit/5ddfd5f1ef28f2041fa07d237ad0336e167b0e0c x_refsource_MISC
• https://github.com/bytecodealliance/wasmtime/commit/7db94cdcf0c79cb3dfde884b534b653f2dd83367 x_refsource_MISC
• https://github.com/bytecodealliance/wasmtime/commit/8a250aac0962ca1364b5f16525720e9d0b39edcd x_refsource_MISC
• https://github.com/bytecodealliance/wasmtime/commit/d3ceb56ec35f39e02496eeb4e2d9c7f4fb964d9e x_refsource_MISC
• https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.11 x_refsource_MISC
• https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.12 x_refsource_MISC
• https://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.3 x_refsource_MISC
• https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.1 x_refsource_MISC

---

wasmtime

• ==>= 25.0.0, < 36.0.12
• ==>= 46.0.0, < 46.0.1
• ==>= 37.0.0, < 45.0.3
• ==< 24.0.11

Permalink CVE-2026-15035

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 day, 3 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 9 hours ago
• @LeSuisse ignored
  4 references

  • https://github.com/bentoml/OpenLLM/
  • Submit #850895 | Bentoml OpenLLM 0.6.30…
  • CVE-2026-15035 | CVE Analysis and Report
  • VDB-376786 | CTI Indicators (IOB, IOC, …
  1 day, 3 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 3 hours ago

bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection

• VDB-376786 | bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection technical-descriptionvdb-entry
• https://github.com/bentoml/OpenLLM/issues/1229 exploitissue-tracking
• https://github.com/bentoml/OpenLLM/pull/1235 patchissue-tracking

Ignored references (4)

• https://github.com/bentoml/OpenLLM/ product
• Submit #850895 | Bentoml OpenLLM 0.6.30 Command Injection third-party-advisory
• CVE-2026-15035 | CVE Analysis and Report third-party-advisory
• VDB-376786 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature

---

OpenLLM

• ==0.6.30

Permalink CVE-2026-59818

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 day, 3 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 9 hours ago
• @LeSuisse ignored
  20 packages

  • netcdf
  • pnetcdf
  • netcdf-mpi
  • netcdfcxx4
  • netcdffortran
  • pkgsRocm.pnetcdf
  • pkgsRocm.netcdf-mpi
  • octavePackages.netcdf
  • python313Packages.etcd
  • python314Packages.etcd
  • python313Packages.aetcd
  • python313Packages.etcd3
  • python314Packages.aetcd
  • python314Packages.etcd3
  • python313Packages.netcdf4
  • python314Packages.netcdf4
  • python313Packages.h5netcdf
  • python314Packages.h5netcdf
  • python313Packages.python-etcd
  • python314Packages.python-etcd
  1 day, 3 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 3 hours ago

etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation

• https://github.com/etcd-io/etcd/security/advisories/GHSA-3wh4-j44w-pg92 x_refsource_CONFIRM
• https://github.com/etcd-io/etcd/pull/22007 x_refsource_MISC
• https://github.com/etcd-io/etcd/pull/22021 x_refsource_MISC
• https://github.com/etcd-io/etcd/pull/22025 x_refsource_MISC
• https://github.com/etcd-io/etcd/commit/2308ce1578064641d4d67c40f0487309267d1bef x_refsource_MISC
• https://github.com/etcd-io/etcd/commit/24838af5a53dd0245adced920e42a9bf0e7a267f x_refsource_MISC
• https://github.com/etcd-io/etcd/commit/8221ae82bc25d4d55ca64382207b69be71038cbb x_refsource_MISC
• https://github.com/etcd-io/etcd/releases/tag/v3.5.32 x_refsource_MISC
• https://github.com/etcd-io/etcd/releases/tag/v3.6.13 x_refsource_MISC

---

etcd

• ==>= 3.6.0-alpha.0, < 3.6.13
• ==< 3.5.32