Security advisories

critical2026-03-27

CVE-2026-33945-Incus has an abitrary file write through its systemd-creds options

lxc/incus · GHSA-q4q8-7f2j-9h9f

high2026-03-27

CVE-2026-33898-Local Incus UI web server vulnerable to nuthentication bypass

lxc/incus · GHSA-453r-g2pg-cxxq

critical2026-03-27

CVE-2026-33897-Incus vulnerable to arbitrary file read and write through pongo templates

lxc/incus · GHSA-83xr-5xxr-mh92

medium2026-03-27

CVE-2026-33743-Incus vulnerable to denial of source through crafted bucket backup file

lxc/incus · GHSA-vg76-xmhg-j5x3

medium2026-03-27

CVE-2026-33711-Incus vulnerable to local privilege escalation through VM screenshot path

lxc/incus · GHSA-q9vp-3wcg-8p4x

high2026-03-27

CVE-2026-33542-Incus does not verify combined fingerprint when downloading images from simplestreams servers

lxc/incus · GHSA-p8mm-23gg-jc9r

medium2026-03-27

CVE-2026-33936-python-ecdsa: Denial of Service via improper DER length validation in crafted private keys

tlsfuzzer/python-ecdsa · GHSA-9f5j-8jwj-x28g

high2026-03-27

Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader

gitroomhq/postiz-app · GHSA-89v5-38xr-9m4j

high2026-03-27

Postiz App has a High-Severity SSRF Vulnerability via Next.js

gitroomhq/postiz-app · GHSA-vj2p-7pgw-g2wf

medium2026-03-27

CVE-2026-33541-TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service

miraheze/tsportal · GHSA-f346-8rp3-4h9h

high2026-03-27

CVE-2026-29788-TSPortal: Any user can forge self-deletion requests for any account

miraheze/tsportal · GHSA-gfhq-7499-f3f2

low2026-03-27

CVE-2026-29071-Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories

open-webui/open-webui · GHSA-w9f8-gxf9-rhvw

medium2026-03-27

CVE-2026-29070-Open WebUI has unauthorized deletion of knowledge files

open-webui/open-webui · GHSA-26gm-93rw-cchf

high2026-03-27

CVE-2026-28788-Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

open-webui/open-webui · GHSA-jjp7-g2jw-wh3j

medium2026-03-27

CVE-2026-27877-Grafana public dashboards disclose all direct mode datasources

grafana/grafana · GHSA-3q27-7qjq-p9c5

medium2026-03-27

CVE-2026-28786-Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`

open-webui/open-webui · GHSA-vvxm-vxmr-624h

high2026-03-27

CVE-2026-27893-vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

vllm-project/vllm · GHSA-7972-pg2x-xr59

high2026-03-27

CVE-2026-22742-Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs

spring-projects/spring-ai · GHSA-mhrg-94vw-45c5

high2026-03-27

CVE-2026-22743-Spring AI has a Cypher Injection vulnerability in Neo4jVectorFilterExpressionConverter

spring-projects/spring-ai · GHSA-7cj7-rcw6-p68v

high2026-03-27

CVE-2026-22744-Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters

spring-projects/spring-ai · GHSA-44f4-gvwj-6qg3