CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...

MAL-2026-16102 Malicious code in mfatest2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15 package.json declares its only runtime dependency as an unpinned GitHub ref "node-net-pool": "github:trktgq0wbre1/node-net-pool" pointing at a...

CVE-2026-87011 Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/openwebui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout...

CVE-2026-87011

Open WebUI , a self-hosted AI platform, contains a denial-of-service vulnerability in the unauthenticated POST /oauth/backchannel-logout handler (backend/open_webui/utils/oauth.py). From version 0.9.0 through 0.11.1 , the handler fetched the OIDC discovery document and signing keys before validat...

CVE-2026-87011 Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/openwebui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout...

CVE-2026-87821

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

EUVD-2026-74847

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-87821

Lara Dashboard versions 0.9.2 through 1.3.1 are affected by a Server-Side Request Forgery (SSRF) in the POST /api/admin/builder/markdown/fetch endpoint. Any authenticated user can supply a malicious URL without host validation or redirect restrictions , allowing them to read the response body of ...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

PT-2026-88959

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-87821: Server-Side Request Forgery (SSRF)

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

MAL-2026-16056 Malicious code in tailwind-aspect-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14 The package's main module src/index.js performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in th...

Malicious code in tailwind-aspect-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14 The package's main module src/index.js performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in th...

MAL-2026-16052 Malicious code in open-item-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457 On require, index.js spawns a detached, unref'd background Node process lib/check-items.js that repeatedly HTTP-GETs a JSON payload from...

Server-side Request Forgery (SSRF)

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the resolveContent method in lib/mailer/mail-message.js. An attacker can read local files or trigger outbound URL fetches b...

MAL-2026-16049 Malicious code in tailwindcss-aspectratio-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b995eb02f80f9037beda9f8a864f55109e054925175289df0c1b29ed8011bc3 src/index.js, referenced by the package main and executed on require, performs an HTTP GET to http://tailwindlan.online, writes the response body to ...

Malicious code in tailwindcss-aspectratio-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b995eb02f80f9037beda9f8a864f55109e054925175289df0c1b29ed8011bc3 src/index.js, referenced by the package main and executed on require, performs an HTTP GET to http://tailwindlan.online, writes the response body to ...

CVE-2026-82757

Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...