ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (5.6.5), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.6.0, <=5.6.5) +38 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (5.5.7)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may MAVEN version 5.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin 5.6.5 -...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=6.0.3, <=6.1.3), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.1.3) +67 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (5.6.36)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may MAVEN version 5.6.36 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin =6.0.3, =6.0.0,...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=6.4.2, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.4.2, <=6.4.7) +74 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (5.6.971)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may MAVEN version 5.6.971 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin =6.4.2, =6.4.2,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.4.0, <=5.4.2), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.4.0, <=5.4.2) +41 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.0)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0,...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (6.4.0), ca.uhn.hapi.fhir:hapi-fhir-cli-api (6.4.0) +30 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.881)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 MAVEN version 5.6.881 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin 6.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.6.0, <=7.4.5) +173 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (>=6.0.0, <=6.9.5)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.4.0, =6.8.0, =8.10.0 and more Source cves: CVE-2026-45367 Source advisory: SNYK:JAVA-CAUHNHAPIFHIR-16757889...

CVE-2026-45398

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, validatecollectionaccess checks the user-memory- and file- collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any...

GHSA-5RV5-XJ5J-3484 Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping

Summary Faraday::Connectionbuildexclusiveurl still allows protocol-relative host override when the request target is provided as a URI object instead of a String. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and can redirect a request built from a fixed-base Faraday::Connection to ...

Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping

Summary Faraday::Connectionbuildexclusiveurl still allows protocol-relative host override when the request target is provided as a URI object instead of a String. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and can redirect a request built from a fixed-base Faraday::Connection to ...

SUSE CVE-2026-6475

Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the orig...

CLSA-2026-1779094874 Fix CVE(s): CVE-2026-28388, CVE-2026-28389

SECURITY UPDATE: NULL pointer dereference in checkdeltabase when a delta CRL is processed without the required CRL Number extension and X509VFLAGUSEDELTAS is enabled, leading to a denial of service. - debian/patches/CVE-2026-28388.patch: add NULL check for delta-crlnumber before ASN1INTEGERcmp in...

Security update for postgresql16

This update for postgresql16 fixes the following issues Update to version 16.13. Security issues: CVE-2026-6472: ensure the user has CREATE privilege on the schema specified bsc1265172. CVE-2026-6473: integer overflows in memory-allocation calculations bsc1265173. CVE-2026-6474: Guard against...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the getKnowledgeBaseForInitialization function. An attacker can gain unauthorized access to knowledge base data and potentially modify or disrupt information by manipulating the kbId...

CVE-2026-8786

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is...

CVE-2026-8786

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is...

EUVD-2026-30730

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is...

CVE-2026-8786 Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is...

CVE-2026-8786 Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is...

CVE-2026-8786 Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is...

PT-2026-41634

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is...