Malicious code in vitest-preview-pro-all (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7 package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavi...

MAL-2026-13405 Malicious code in vitest-preview-pro-all (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7 package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavi...

Important: Red Hat Security Advisory: RHTAS 1.4.3 - Tech Preview Release Of the Model Validation Operator

The Tech Preview release of the RHTAS Model Validation Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Model Validation Operator can be used with OpenShift Container Platform 4.16, 4.17,...

Important: Red Hat Security Advisory: RHTAS 1.4.3 - Tech Preview Release Of the Go based Model Transparency CLI

The Tech Preview release of the Go based RHTAS Model Transparency CLI image. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The Go based RHTAS Model Transparency CLI image can be used to sign and verify AI/M...

Malware in hubert-application-get-document-preview-am

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in vitest-preview-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...

MAL-2026-12004 Malicious code in vitest-preview-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...

MAL-2026-11540 Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...

CVE-2026-70486

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

GHSA-3XPF-XQ7R-V8C5 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Summary Any authenticated user with access to a terminal server could get script of their choosing to run in the Open WebUI origin itself. The HTML file preview rendered terminal-served files in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, and the file is serv...

CVE-2026-70486 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

EUVD-2026-52893

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

CVE-2026-70486 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

CVE-2026-70486 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

CVE-2026-70486

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

CVE-2026-70486

Open WebUI (self-hosted AI platform) versions 0.9.0–0.11.0 contain a Same-Origin/XSS risk in the terminal file-preview iframe: the serveUrl iframe branch granted allow-same-origin and allow-scripts for HTML files from the app origin, enabling an authenticated user with terminal server access to r...

arkindex-base-worker (>=0.3.6, <=0.3.7rc1), markdown-live-preview (>=0.2.48, <=0.2.53) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.5.0)

pymdown-extensions PYPI version 10.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.6, =0.2.48, =0.11.0, =0.12.2 Source cves: CVE-2026-61632 Source advisory: OSV:PYSEC-2026-3609...

labext-pkg (2.3.1), markdown-live-preview (>=0.2.67, <=0.2.68) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.8.1)

pymdown-extensions PYPI version 10.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - labext-pkg 2.3.1 - markdown-live-preview =0.2.67, =12.0.25, =12.0.26 Source cves: CVE-2026-61632 Source advisory:...

edubotics-core (>=0.1.3, <=0.1.7), lexical-workspace (>=0.1.0, <=0.2.0) +5 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.9.0)

pymdown-extensions PYPI version 10.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - edubotics-core =0.1.3, =0.1.0, =12.0.27, =1.0.0, =1.0.0, =1.2.4 Source cves: CVE-2026-61632 Source advisory:...

arkindex-base-worker (>=0.3.7rc2, <=0.3.7rc10), mafiagg (>=1.0.0, <=1.0.4) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.7.0)

pymdown-extensions PYPI version 10.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - arkindex-base-worker =0.3.7rc2, =1.0.0, =0.2.54, =0.2.65 Source cves: CVE-2026-61632 Source advisory: OSV:PYSEC-2026-3609...