CVE Vulnerability Catalog

Open WebUI from 0.9.0 until 0.11.0 has a vulnerability in the terminal file-preview serveUrl iframe branch, which always grants allow-same-origin and allow-scripts for HTML files. Any authenticated user with access to a configured terminal server could cause script execution in the Open WebUI origin, steal the victim's session token, and take over the account, with possible server-side code execution if the victim was an admin.

Open WebUI from 0.9.0 to 0.11.0 checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal IPv6 address without examining IPv4 addresses embedded in transition encodings. On a deployment with a NAT64 gateway, any verified user could wrap an internal or cloud-metadata IPv4 address in the NAT64 well-known prefix, pass the filter, and receive the internal response body through RAG URL ingestion, URL-to-markdown conversion, or web-search content retrieval.

Open WebUI from 0.8.0 until 0.11.0 has a vulnerability in the OAuth token exchange mechanism. When ENABLE_OAUTH_TOKEN_EXCHANGE=True, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it without confirming which OAuth client the token was issued to. Anyone holding an access token for any client registered with the same provider could exchange it for an Open WebUI session as that token user.

Open WebUI from 0.9.6 to 0.11.0, with WEB_LOADER_ENGINE=playwright, validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated user can use JavaScript to reach blocked internal addresses, and returned DOM can include data read from those addresses in web-search or RAG output.

Flowise prior to 3.1.3 does not verify that the Stripe subscriptionId belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing plans or seat quantities.

Flowise prior to 3.1.3 has a vulnerability in the PUT /api/v1/executions/:id endpoint, which lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results.

CVAT versions 1.6.0 through 2.64.0 contain a vulnerability that allows an attacker with write access to a cloud storage added to a CVAT instance, or ability to add new cloud storages, to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.

A security vulnerability has been detected in H3C NX15 V100R017. An unknown function in the file /api/wizard/networkSetup lacks authentication. The attack may be performed remotely.

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in the directory. To remediate this issue, users should upgrade to version 2.10.0 or higher.

An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory.

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0. An authenticated attacker could execute arbitrary OS commands as a privileged user under a specific circumstance.

Flowise prior to 3.1.3 has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. This allows any authenticated user to initiate OAuth2 flows against credentials of other workspaces, and allows unauthenticated attackers to overwrite tokens or refresh tokens for any credential.

Flowise before version 3.1.3 does not scope the upsert history to the requesting user, tenant, or workspace. The response from GET /api/v1/upsert-history can exceed 100MB and includes sensitive configuration data, including Vector Store settings such as Qdrant Server URL and collection name. Missing authorization, isolation, and pagination expose integration parameters and infrastructure details.

Flowise before version 3.1.3 in openai-assistants-vector-store endpoints accepts a client-controlled credential parameter and loads credentials by id without checking ownership. Route permissions assistants:* only check feature access, and the controller passes req.query.credential to the service, which decrypts and uses it without workspaceId check. An attacker knowing another workspace's credentialId can use that workspace's OpenAI key, read, modify, or delete victim vector stores and files, cause billing impact, and violate multi-tenant boundaries.

Flowise prior to 3.1.3 injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. A user or API key denied variables:view can call /api/v1/node-custom-function and receive all workspace variables, including secrets.

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. This happens because load_plugins() runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and immediately executes any line beginning with import, so the code runs with the privileges of the user invoking pdm and even a benign command such as pdm --version triggers it (making the impact strongest in CI, automation, and privileged contexts).

pdm is a Python package and dependency manager. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files.

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit might lead to denial of service and data tampering.

NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forgery. A successful exploit might lead to information disclosure.