Security Advisories | GitStock

critical2026-09-10

CVE-2026-88007-Traefik HTTP/3 Backend NTLM Connection Reuse

traefik/traefik · GHSA-qqjf-53cj-pwvv

high2026-09-10

CVE-2026-88009-Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

traefik/traefik · GHSA-f52w-8j3h-j724

medium2026-09-10

CVE-2026-88014-rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone/rclone · GHSA-66hp-wgxq-6f5q

low2026-09-10

CVE-2026-88013-rclone: http backend forwards custom/auth headers to a different host on redirect

rclone/rclone · GHSA-486v-q2wf-fp2r

medium2026-09-10

CVE-2026-88016-rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

rclone/rclone · GHSA-f8g7-2xjc-7mfh

medium2026-09-10

CVE-2026-88015-rclone local: crafted Range request against a translated symlink panics (DoS)

rclone/rclone · GHSA-p6m2-r3w9-mpxw

critical2026-09-10

CVE-2026-88018-rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone/rclone · GHSA-xwwr-4h3p-r22c

critical2026-09-10

CVE-2026-88044-rclone: RC per-server auth-proxy bypass

rclone/rclone · GHSA-p569-5gjg-9cmj

high2026-09-10

CVE-2026-88017-rclone: FTP cross-session auth-proxy backend confusion

rclone/rclone · GHSA-c476-6w5q-jw77

medium2026-09-10

CVE-2026-88046-rclone: source object names can escape the configured root on upload

rclone/rclone · GHSA-38xv-hf3p-h7mq

high2026-09-10

CVE-2026-88045-rclone: S3 multipart declared-length memory exhaustion

rclone/rclone · GHSA-2p48-j3qc-rx9f

high2026-09-10

CVE-2026-87011-Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

open-webui/open-webui · GHSA-3g9q-v48f-hh9w

medium2026-09-10

CVE-2026-87012-Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

open-webui/open-webui · GHSA-v39v-59xw-j98g

medium2026-09-10

CVE-2026-87013-Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

open-webui/open-webui · GHSA-8r35-5x5r-hv74

medium2026-09-10

CVE-2026-87014-Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

open-webui/open-webui · GHSA-wjwr-xfp9-r66p

high2026-09-10

[email protected]/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

jhb-software/payload-plugins · GHSA-4qpv-39hg-f7fx

high2026-09-10

CVE-2026-59960-@argos-ci/core: CI Branch Name OS Command Injection

argos-ci/argos-javascript · GHSA-4x45-gxvp-6283

high2026-09-10

mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS

ericlbuehler/mistral.rs · GHSA-m3wp-48jr-vr4g

high2026-09-10

mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url

ericlbuehler/mistral.rs · GHSA-wfgq-w7cq-qj7j

medium2026-09-10

CVE-2026-87015-Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

open-webui/open-webui · GHSA-p78m-89r6-pgf7

← Previous 1 75 76 77 78 79 1540 Next →