Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Affects: Open WebUI
Advisories
Security advisories for popular AI software, newest first, each linked to its public source.
282 advisories rated Medium
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector…
Affects: Open WebUI
Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
Affects: Open WebUI
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Affects: Open WebUI
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
Affects: Open WebUI
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Affects: Open WebUI
n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
Affects: n8n
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git…
Affects: n8n
n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter
Affects: n8n
n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
Affects: n8n
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role…
Affects: n8n
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
Affects: n8n
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
Affects: n8n
n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to…
Affects: n8n
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
Affects: n8n
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
Affects: n8n
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
Affects: n8n
Langflow: IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in…
Affects: Langflow
n8n: N8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the…
Affects: n8n
n8n: N8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy…
Affects: n8n
n8n: N8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the…
Affects: n8n
n8n: N8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and…
Affects: n8n
n8n: N8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the…
Affects: n8n
n8n: N8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline…
Affects: n8n
Langflow: IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF)
Affects: Langflow
vLLM: VLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit…
Affects: vLLM
n8n: N8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG…
Affects: n8n
n8n: In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not…
Affects: n8n
n8n: N8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression…
Affects: n8n
n8n: N8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability…
Affects: n8n
n8n: N8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit…
Affects: n8n
n8n: N8n versions before 2.34.1 contain a credential validation bypass in the MCP…
Affects: n8n
n8n: N8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2…
Affects: n8n
NVIDIA Triton Inference Server: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause…
Affects: NVIDIA Triton Inference Server
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio…
Affects: vLLM
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
Affects: vLLM
vLLM: Completion prompt lists fan out into unbounded engine requests
Affects: vLLM
vLLM: Cross-User Data Leak Vulnerability
Affects: vLLM
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
Affects: vLLM
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout)…
Affects: vLLM