EUVD-2026-53212

art-template's sub-template resolution logic src/compile/adapter/resolve-filename.js, used by both the include and extend template directives, resolves the target file path via path.resolveroot, filename with no check afterward that the result remains inside root. Because path.resolve discards ro...

GHSA-W2RX-84HP-GG95 Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pa...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the SafePlaywrightURLLoader process. An attacker can access sensitive internal resources by submitting a crafted URL when the Playwright web loader is enabled, allowing th...

CVE-2026-70479

Open WebUI vulnerability CVE-2026-70479 affects the self-hosted Open WebUI platform. From versions 0.9.6 through 0.11.0, when WEB_LOADER_ENGINE=playwright is used, the Playwright web loader validates only the top-level page requests and allows sub-resource requests to pass unvalidated. This enabl...

CVE-2026-70479 Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEBLOADERENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated...

EUVD-2026-52915

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEBLOADERENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated...

CVE-2026-70479 Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEBLOADERENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated...

PT-2026-67832

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.9 Description When the WEB LOADER ENGINE variable is set to playwright, the Playwright web loader only validates the top-level page request, allowing sub-resource requests to pass unvalidated. An...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571 Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

CVE-2026-18571

CVE-2026-18571 affects Keycloak’s user creation flow when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. The flaw lets a sub-administrator with permission to create users add those users to any group, including groups the administrator isn’t authorized to manage, potentially enabling una...

EUVD-2026-51925

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could...

PT-2026-67136

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the user creation component when Fine-Grained Admin Permissions V2 FGAP V2 is enabled. This issue allows a sub-administrator who has permission to create users to assign tho...

[SECURITY] Fedora 43 Update: valkey-8.1.9-1.fc43

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

[SECURITY] Fedora 44 Update: valkey-9.0.5-1.fc44

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

SUSE CVE-2026-55432

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a...

Missing Authorization

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the user creation path in UsersResource.create and...

n8n Node.js Package < 2.27.4 / 2.28.0 < 2.28.1 Account Takeover (CVE-2026-59208)

The version of the n8n Node.js Package installed on the remote host is prior to 2.27.4, or is 2.28.x prior to 2.28.1. It is, therefore, affected by an account takeover vulnerability: - n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instanc...

UBUNTU-CVE-2026-64379

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...