31 matches found
PurpleKeep
Description With the rapidly increasing variety of attack techniques and a simultaneous rise in the number of detection rules offered by EDRs Endpoint Detection and Response and custom-created ones, the need for constant functional testing of detection rules has become evident. However, manually...
PYSEC-2026-4116 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
SummaryOpen WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is globall...
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...
GHSA-34R3-9M95-VQ73 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...
EUVD-2026-75184
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch...
CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
CVE-2026-87999
Open WebUI (a self-hosted AI platform) had a server-side request forgery (SSRF) vulnerability in backend/open_webui/retrieval/web/utils.py, affecting the POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search endpoints. The root cause was that Python's globally routable ...
CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
CVE-2026-87999: Server-Side Request Forgery (SSRF)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
Server-Side Request Forgery SSRF in Azure MCP Server allows an authorized attacker to elevate privileges over a network...
EUVD-2026-29578
Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network...
GHSA-PRGG-RGFW-VR94 vulnerabilities
Vulnerabilities for packages: linux-aws, linux-qemu, linux-azure, linux-gcp, linux-vmware...
hays-london-azure-platform-2-poc
Hays London Azure Platform Engineer POC — AKS Operations & Pla...
Microsoft Azure DevOps 安全漏洞
Microsoft Azure DevOps is a team collaboration platform provided by the American company Microsoft. There is a security vulnerability in Microsoft Azure DevOps, which stems from insufficient credential protection. This vulnerability could allow unauthorized attackers to gain elevated privileges...
Microsoft Azure Arc Access Control Error Vulnerability
Microsoft Azure Arc is a storage system from Microsoft USA. that extends the Azure platform into your environment. Microsoft Azure Arc has an Access Control Error vulnerability that can be exploited by an attacker to elevate privileges...
CVE-2025-55697 Azure Local Elevation of Privilege Vulnerability
...
Microsoft raises the bar: A smarter way to measure AI for cybersecurity
ExCyTIn-Bench is Microsoft’s newest open-source benchmarking tool designed to evaluate how well AI systems perform real-world cybersecurity investigations.1 It helps business leaders assess language models by simulating realistic cyberthreat scenarios and providing clear, actionable insights into...