7801 matches found
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...
CVE-2026-70483
Open WebUI (self-hosted AI platform) contained an authorization bypass in the delete_chat_by_id handler (backend/open_webui/routers/chats.py) serving DELETE /api/v1/chats/{id}. The in-flight task cancellation was placed before ownership and permission checks, so any authenticated user with the de...
UBUNTU-CVE-2026-47781
PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...
CLSA-2026-1785204577 TuxCare security update for 2 packages (1 CVE)
TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 19.2.0-tuxcare.6...
CLSA-2026-1785380362 TuxCare security update for org.springframework.integration (1 CVE)
TuxCare rebuilt 43 org.springframework.integration packages to address 1 CVE. Fixed in 6.4.10-tuxcare.1...
CLSA-2026-1785291358 TuxCare security update for org.apache.httpcomponents (1 CVE)
TuxCare rebuilt 3 org.apache.httpcomponents packages to address 1 CVE. Fixed in 4.5.10-tuxcare.1...
CLSA-2026-1785291242 TuxCare security update for protobufjs (1 CVE)
TuxCare rebuilt protobufjs to address 1 CVE. Fixed in 5.0.0-tuxcare.1...
CLSA-2026-1785291682 TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.21.4-tuxcare.3...
CLSA-2026-1784943203 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.3-tuxcare.7...
CLSA-2026-1784856319 TuxCare security update for 7 packages (2 CVEs)
TuxCare rebuilt 7 packages to address 2 CVEs. Fixed in 26.0.0-tuxcare.1...
CLSA-2026-1784769562 TuxCare security update for io.undertow (1 CVE)
TuxCare rebuilt 8 io.undertow packages to address 1 CVE. Fixed in 2.3.20.Final-tuxcare.1...
CLSA-2026-1784856203 TuxCare security update for engine.io (2 CVEs)
TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 1.8.3-tuxcare.1...
CLSA-2026-1784769564 TuxCare security update for angular (1 CVE)
TuxCare rebuilt angular to address 1 CVE. Fixed in 1.5.11-tuxcare.9...
CLSA-2026-1784856026 TuxCare security update for 13 packages (1 CVE)
TuxCare rebuilt 13 packages to address 1 CVE. Fixed in 2.18.1-tuxcare.3...
CLSA-2026-1784683085 TuxCare security update for jsonwebtoken (1 CVE)
TuxCare rebuilt jsonwebtoken to address 1 CVE. Fixed in 0.3.0-tuxcare.1...
CLSA-2026-1784769536 TuxCare security update for 2 packages (2 CVEs)
TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 3.2.0-tuxcare.4...
CLSA-2026-1784682933 TuxCare security update for org.assertj (1 CVE)
TuxCare rebuilt 4 org.assertj packages to address 1 CVE. Fixed in 3.24.2-tuxcare.1...
CLSA-2026-1784682834 TuxCare security update for org.apache.commons:commons-configuration2 (1 CVE)
TuxCare rebuilt org.apache.commons:commons-configuration2 to address 1 CVE. Fixed in 2.12.0-tuxcare.1...