CVE-2026-87797: Missing Authorization

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other user...

PT-2026-90583

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other user...

tmux v3.8-rc

Welcome to tmux! tmux is a terminal multiplexer: it enables a number of terminals to be created, accessed, and controlled from a single screen. tmux may be detached from a screen and continue running in the background, then later reattached. This release runs on OpenBSD, FreeBSD, NetBSD, Linux,...

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

GHSA-WJWR-XFP9-R66P Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

CVE-2026-82791

creationtimestamp| type| source ---|---|--- 2026-09-10 08:46:32+00:00| seen| https://jvn.jp/en/vu/JVNVU90314828...

CVE-2026-82793

creationtimestamp| type| source ---|---|--- 2026-09-10 08:46:28+00:00| seen| https://jvn.jp/en/vu/JVNVU90314828...

CVE-2026-82777

creationtimestamp| type| source ---|---|--- 2026-09-10 08:46:01+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518...

CVE-2026-82788

creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:58+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518...

CVE-2026-82776

creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:56+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518...

CVE-2026-82789

creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:43+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518...

CVE-2026-82762

creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:39+00:00| seen| https://jvn.jp/en/vu/JVNVU99009004...

CVE-2026-82771

creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:27+00:00| seen| https://jvn.jp/en/vu/JVNVU99009004...

CVE-2026-82764

creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:18+00:00| seen| https://jvn.jp/en/vu/JVNVU99009004 2026-09-10 08:46:17+00:00| seen| https://jvn.jp/en/vu/JVNVU96551518 2026-09-10 08:46:34+00:00| seen| https://jvn.jp/en/vu/JVNVU90314828...

CVE-2026-82796

creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:14+00:00| seen| https://jvn.jp/en/vu/JVNVU97753461...

CVE-2026-82794

creationtimestamp| type| source ---|---|--- 2026-09-10 08:45:10+00:00| seen| https://jvn.jp/en/vu/JVNVU97753461...

CVE-2026-87014

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2026-87014 Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...