UBUNTU-CVE-2026-67860

open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend...

Malicious code in bigops-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41 On require, adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames assembled at runtime by...

MAL-2026-11535 Malicious code in bigops-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ff97c8d7575ac702d4fe30fa39cbe89845d1b09d849de0d50a5edcdd554af41 On require, adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames assembled at runtime by...

Directory Traversal

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Directory Traversal in the database backup and export filename handling through the backup/export filename processing in the admin backend and exporter modules. An administrator-level attacker can overwrit...

CVE-2026-70619

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...

CVE-2026-70619 Odysseus Missing Admin Authorization via Embedding Endpoint Routes

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...

CVE-2026-70619 Odysseus Missing Admin Authorization via Embedding Endpoint Routes

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...

CVE-2026-70619 Odysseus Missing Admin Authorization via Embedding Endpoint Routes

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...

CVE-2026-70619

Odysseus has a missing authorization flaw in embedding endpoint management routes (pre-commit bf325f6) that lets authenticated non-admin users overwrite server-wide embedding backend configuration via management routes that only verify session authentication. The attacker-controlled URL can cause...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the syncknowledgecleanup handler in the backend, which processes directory and file IDs from the request body without verifying their association with the specified knowledge...

xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow

A flaw was found in the glamorfontget function of the xorg-x11-server. This vulnerability, a heap buffer overflow, occurs when the server processes a specially crafted PCF font file where individual glyph metrics exceed the declared maximum bounds. An authenticated X client can exploit this by...

CVE-2026-69100

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the scrip...

Malicious code in @arv-bedrock/auth-sso-backend (npm)

npm/@arv-bedrock/auth-sso-backend is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

PYSEC-2026-3596 Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Summary Two regexes in backend/openwebui/utils/middleware.py that parse skill-mention tags backtrack in On² on input that contains . Both run synchronously, on the asyncio event loop, on every chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one suc...

CVE-2026-67860

open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend...

PT-2026-67832

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.9 Description When the WEB LOADER ENGINE variable is set to playwright, the Playwright web loader only validates the top-level page request, allowing sub-resource requests to pass unvalidated. An...

PT-2026-67882

Name of the Vulnerable Software and Affected Versions open62541 version 1.5.5 Description A heap-based buffer overflow occurs in the default HistoryRead path when the default history database is utilized with the memory backend. A heap-based buffer overflow is a memory corruption issue where a...

CVE-2026-70490: Incorrect Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...

Veeam Backup for Salesforce Backend Service Fails to Start After Upgrading to Version 3.2.1 or Later

Challenge After Veeam Backup for Salesforce is upgraded from version 2.1.1 or earlier to version 3.2.1 or later, the vbsf-backend service fails to start. The state of the service can be confirmed with the following command: sudo systemctl status vbsf-backend Copy The output shows that the service...

PT-2026-67903

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...