Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

PYSEC-2026-1731 Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2024-50378 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2024-50378 Source advisory: OSV:PYSEC-2026-1134...

docker-compose-control-center (>=3.1.1, <=3.1.2) potentially affected by CVE-2024-45231 via django (2.1.11)

django PYPI version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =3.1.1, =3.1.2 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

docker-compose-control-center (>=2.4.0, <=3.0.0) potentially affected by CVE-2024-45231 via django (2.1.8)

django PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =2.4.0, =3.0.0 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

docker-compose-control-center (3.1.0) potentially affected by CVE-2024-45231 via django (2.1.10)

django PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center 3.1.0 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

chaste-codegen (>=0.4.0, <=0.10.2), docker-tidy (>=0.1.0, <=0.1.4) +6 more potentially affected by CVE-2024-5569 via zipp (1.2.0)

zipp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on zipp and may be impacted: - chaste-codegen =0.4.0, =0.1.0, =0.7.10, =1.18.3, =26.0.0, =1.0.4, =1.0.6 - mapyllary 0.0.6 Source cves: CVE-2024-5569 Source advisory: OSV:PYSEC-2026-20...

cobras (>=1.7.7, <=2.1.7), docker-cluster-controller (0.1.23) potentially affected by CVE-2024-40647 via sentry-sdk (0.11.2)

sentry-sdk PYPI version 0.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - cobras =1.7.7, =2.1.7 - docker-cluster-controller 0.1.23 Source cves: CVE-2024-40647 Source advisory: OSV:PYSEC-2026-1917...

dbxfs (>=1.0.51, <=1.0.54), fourutils (0.2.1) +11 more potentially affected by CVE-2024-40647 via sentry-sdk (0.20.3)

sentry-sdk PYPI version 0.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - dbxfs =1.0.51, =2.8.1289, =1.4.1rc1, =1.0.4, =0.2.2, =3.3.0, =0.0.7, =2.5.0, =2.5.1 - sentrylogs 0.5.0 - shy-sentry 1.2.0 Source cves:...

PYSEC-2026-2068 Improper line feed handling in zenml

A denial of service DoS vulnerability exists in zenml-io/zenml version 0.56.3 due to improper handling of line feed \n characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a \n character, it...

PYSEC-2026-2069 zenml-io/zenml does not expire the session after password reset

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the...

zenml-io/zenml does not expire the session after password reset

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the...

Malicious code in postgres-docker-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7349 Malicious code in postgres-docker-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

OPENSUSE-SU-2026:21247-1 Security update for docker-compose

This update for docker-compose fixes the following issues - CVE-2025-0495: buildx: credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration bsc1239766. - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the...

SUSE-SU-2026:22567-1 Security update for docker-compose

This update for docker-compose fixes the following issues - CVE-2025-0495: buildx: credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration bsc1239766. - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2026-49487 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2026-49487 Source advisory: OSV:GHSA-22HF-VX2V-GJFF...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2026-49296 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2026-49296 Source advisory: OSV:GHSA-4FH7-7JX4-8F6C...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2026-33264 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2026-33264 Source advisory: OSV:GHSA-2943-9672-R45W...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2026-48828 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2026-48828 Source advisory: OSV:GHSA-563F-2439-RMQ4...