7497 matches found
CLSA-2026-1768781325 TuxCare security update for io.rsocket (1 CVE)
TuxCare rebuilt 7 io.rsocket packages to address 1 CVE. Fixed in 1.1.3-tuxcare.1...
CLSA-2026-1771978231 TuxCare security update for socket.io (1 CVE)
TuxCare rebuilt socket.io to address 1 CVE. Fixed in 2.1.1-tuxcare.1...
CLSA-2026-1770682162 TuxCare security update for io.undertow (1 CVE)
TuxCare rebuilt 8 io.undertow packages to address 1 CVE. Fixed in 2.2.33.Final-tuxcare.2...
CLSA-2026-1768781329 TuxCare security update for io.projectreactor.netty (1 CVE)
TuxCare rebuilt 4 io.projectreactor.netty packages to address 1 CVE. Fixed in 1.1.15-tuxcare.1...
CLSA-2026-1768781328 TuxCare security update for io.undertow (2 CVEs)
TuxCare rebuilt 8 io.undertow packages to address 2 CVEs. Fixed in 2.3.10.Final-tuxcare.3...
CLSA-2025-1766016491 TuxCare security update for io.undertow (4 CVEs)
TuxCare rebuilt 8 io.undertow packages to address 4 CVEs. Fixed in 2.3.10.Final-tuxcare.1...
CLSA-2025-1764634061 TuxCare security update for commons-io:commons-io (1 CVE)
TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.5-tuxcare.1...
CLSA-2025-1766534903 TuxCare security update for io.undertow (4 CVEs)
TuxCare rebuilt 8 io.undertow packages to address 4 CVEs. Fixed in 2.3.10.Final-tuxcare.2...
CLSA-2025-1762992412 TuxCare security update for io.undertow (1 CVE)
TuxCare rebuilt 8 io.undertow packages to address 1 CVE. Fixed in 2.2.33.Final-tuxcare.1...
CLSA-2025-1759795577 TuxCare security update for commons-io:commons-io (1 CVE)
TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.7-tuxcare.1...
mingw-glib2 security update
An update is available for mingw-glib2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GLib provides the core application building blocks for libraries and...
Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)
SummaryThe Socket.IO server is configured with alwaysconnect=True lines 78, 91 in backend/openwebui/socket/main.py and the connect handler line 329 never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with...
PYSEC-2026-3595 Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...
PYSEC-2026-3592 Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
Summary An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller geteventcall delivers execute:python / execute:tool events to a client-supplied sessionid after only checking that the sessio...
Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
SummaryWith Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perform...
PT-2026-74273
TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.5-tuxcare.2...
PT-2026-74740
TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.6-tuxcare.1...
PT-2026-75323
TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.4-tuxcare.2...