file-upload
1 live · 9 on record · last incident 15 days ago
Live1
- live4.3Ivanti Connect Secure CVE-2026-118527: Ivanti Connect Secure Identifier Generation Flaw
Patch now · Exploited · Patched · since 30 Oct 2026 · updated 2 Nov 2026 · CVE-2026-118527
Ivanti Connect Secure contains a predictable identifier vulnerability that enables remote authenticated users to upload arbitrary files to disk. CISA added the issue to its Known Exploited Vulnerabilities catalog.
Do:Update Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6.
Earlier8
- closed8.7Open WebUI CVE-2026-45315: Open WebUI stored XSS via audio transcription uploads
Patch now · Disclosed · since 14 May 2026 · updated 15 May 2026 · CVE-2026-45315
AI - closed7.3Open WebUI CVE-2026-44566: Open WebUI arbitrary file upload and path traversal
Patch now · Disclosed · since 8 May 2026 · updated 15 May 2026 · CVE-2026-44566
AI - closed6.9Dify CVE-2026-42138: Unauthenticated XSS vulnerability in Dify
Patch now · Disclosed · since 4 May 2026 · CVE-2026-42138
AI - closed7.1Flowise CVE-2026-41269: Flowise file upload validation bypass leads to RCE
Patch now · Disclosed · since 16 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41269
AI - closed8.2Flowise CVE-2026-30821: Flowise Arbitrary File Upload via MIME Spoofing
Patch now · Disclosed · since 6 Mar 2026 · updated 7 Mar 2026 · CVE-2026-30821
AI - closed3.7Vercel AI SDK CVE-2025-48985: Vercel AI SDK filetype whitelist bypass vulnerability
Patch now · Disclosed · since 7 Nov 2025 · CVE-2025-48985
AI - closed8.3Flowise CVE-2025-61687: Flowise file upload vulnerability leads to RCE
Patch now · Disclosed · since 6 Oct 2025 · updated 8 Oct 2025 · CVE-2025-61687
AI - closed8.9Flowise Arbitrary File Upload Vulnerability in FlowiseAI Flowise
Patch now · Disclosed · since 4 Mar 2025 · updated 5 Mar 2025 · CVE-2025-26319
AI