CVE-2017-20289

Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-71433

Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Usekaneo

Products

Kaneo

CVE-2026-18361

DFIR-IRIS Stored XSS in Datastore Upload

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Dfir-iris

Products

Iris

CVE-2026-15929

SQL Injection Vulnerability in LG SmartShare

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL Injection. This issue affects SmartShare: through 2.3.1712.1202, which is supported on Microsoft Windows 10 and earlier versions.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Lg Electronics

Products

Smartshare

CVE-2026-17934

chromium-browser: chromium-browser: Insufficient validation of untrusted input in DevTools

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-72809

SiYuan before v3.7.4 Authentication Bypass via Localhost Trust

SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request whose RemoteAddr is loopback (127.0.0.1) for a specific set of endpoints (including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*). These localhost bypasses sit outside the access auth code gate, so they apply even when an access auth code is configured. Because the fixed-port reverse proxy forwards requests to the kernel over loopback without injecting an authentication token and does not configure trusted proxies, a request forwarded through this proxy reaches the kernel with RemoteAddr = 127.0.0.1. If the fixed-port proxy is bound to a network interface, this could allow a remote unauthenticated attacker to obtain admin access on the affected endpoints; however, per the advisory this remote forwarding behavior was established only by code inspection and was not reproduced end-to-end.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

B3log Siyuan

Products

Siyuan Siyuan

CVE-2026-62663

Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document)

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters (image, audio, video, document) in banks accept untrusted user input as file paths via Path(value) and pass them directly to open(file_path, "rb") without any path sanitization, canonicalization, or directory restriction. An attacker who controls template variables passed to a banks Prompt can use path traversal (../) to read arbitrary files accessible to the Python process—including .env files, SSH keys, cloud credentials, source code, /etc/passwd, and /etc/shadow—with the content returned base64-encoded in the rendered prompt output, making exfiltration trivial. This is particularly dangerous for applications that use banks to process user-provided template variables before sending prompts to an LLM. This issue has been fixed in version 2.4.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Masci

Products

Banks

CVE-2026-44093

Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Phoenix Contact Phoenixcontact

Products

Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more

CVE-2026-17931

chromium-browser: chromium-browser: Inappropriate implementation in DevTools

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2025-67527

WordPress Digiqole theme < 2.2.7 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in trippleS Digiqole digiqole allows PHP Local File Inclusion.This issue affects Digiqole: from n/a through < 2.2.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2026-97643

GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes (`filter_by`, `layout`, `sort_by`, `order_by`) in the CampaignGridShortcode::parseAttributes() function combined with the render template emitting `json_encode($attributes)` inside a single-quoted HTML attribute without esc_attr() — json_encode() does not escape single quotes by default, so a `'` in an attribute value breaks out of the enclosing attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Stellarwp Wordpress-extensions

Products

Givewp Givewp

CVE-2026-85571

Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR

The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Tutor Lms

CVE-2026-109299

Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openwebui

Products

Open Webui

CVE-2026-109298

Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openwebui

Products

Open Webui

CVE-2026-109297

Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Open-webui Openwebui

Products

Open-webui Open Webui

CVE-2026-109296

Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openwebui

Products

Open Webui

CVE-2026-109295

Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openwebui

Products

Open Webui

CVE-2026-109294

Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openwebui

Products

Open Webui

CVE-2026-109290

Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Open-webui Openwebui

Products

Open-webui Open Webui

CVE-2026-109287

Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Open-webui Openwebui

Products

Open-webui Open Webui