CVE-2026-18974 heshengtao super-agent-party execute_tool_manually Endpoint server.py get_file_content information disclosure

A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function getfilecontent of the file server.py of the component executetoolmanually Endpoint. The manipulation of the argument toolname/toolparams results in information disclosure. The attack can be launched...

GHSA-6XHV-RXHV-PWM4 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...

CVE-2026-70487 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file i...

CVE-2026-70487 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file i...

CVE-2026-70487

Open WebUI (versions 0.8.8–0.11.0) allowed client-supplied knowledge attachments in an inline model to bypass read access checks, enabling any authenticated user who knows another user’s file id to retrieve indexed chunks from that file via builtin knowledge tools. This caused read-only cross-use...

CVE-2026-70487 Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file i...

SUSE CVE-2026-44884

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint GET...

SUSE CVE-2026-45046

Gryph provides a security layer for AI coding agents. Prior to 0.7.0, Gryph implements logging levels that determine what content is logged to a local sqlite database. The README incorrectly mentions that the default log level is minimal while it is standard. Source code review shows sensitive...

CVE-2026-12357 Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability

Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specif...

PT-2026-64200

Name of the Vulnerable Software and Affected Versions Heimdall Data Database Proxy affected versions not specified Description Remote authenticated attackers can execute arbitrary code with root privileges on affected installations. The issue stems from the lack of proper neutralization of CRLF...

CVE-2026-50162

A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link symlink traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside...

PYSEC-2026-2761 Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

Summary Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats meta.knowledge entries of type file as an authorization source in two...

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

SummaryOpen WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats meta.knowledge entries of type file as an authorization source in two...

PYSEC-2026-3076 stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution

A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution...

PT-2026-59402

Summary Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats meta.knowledge entries of type file as an authorization source in two...

CVE-2026-54528

A flaw was found in JupyterLab Git, a Git extension for JupyterLab. This vulnerability allows an authenticated user on a case-insensitive filesystem to bypass administrator-configured excluded paths by varying the case of the URL path segment. This bypass enables the user to read file content, vi...

GHSA-28JH-G32X-V9V4 Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values

Summary Tesla.Multipart.partheadersfordisposition/1 interpolates Content-Disposition parameter values field name, filename, and other opts verbatim into the part header line without encoding or escaping any special characters. An attacker who controls a filename, field name, or other disposition...

Open WebUI allows limited stored XSS vila uploaded html file

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

Mage AI Path Traversal vulnerability

Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "File Content" request...