PYSEC-2026-2702 Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature

SSRF Bypass via IPv6/IPv4-mapped IPv6/IPv4-reserved-ranges in validateurl Summary validateurl in backend/openwebui/retrieval/web/utils.py calls validators.ipv6ip, private=True, but the validators library does NOT implement the private keyword for IPv6 — the call raises a ValidationError which is...

EUVD-2026-37856

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the Personal File Storage PFS module. In modules/pfs/inc/pfs.editfolder.php, the folder update action 'a=update' updates folder metadata title, description, public/gallery flags without calling cotcheckxg ...

Malicious code in global-apollo-dysonswarm-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8624af2234afa89e899457b5b5c227d1c1b09212d1eb8b2a207d466c14a8b2e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in singularity-kuiperbelt-loopback-fermiparadox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1afa76f7fe37851e702aa99f703e08b3365b03f94bca78843a30a75678da27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elektra-supercluster-genomics-heliophysics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 151aa85ff2dca1946cd00a3716ecb72519fd01ae04977e10d71f8a48361320bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in global-docusaurus-postcss-ora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8df4f9814159eb8eac2592d283efc63cc900f4be3c84336bf15ee23c60433c6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cygnus-got-nconf-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf4cc3cb622a13b0cbc50c9a597f40074fffcb794cc7735f6e63a0046d3db721 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in epimetheus-loglevel-membrane-solarnebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3882f96f6ba94008491b8b2d879161bdb319ae0eee595576b6f91e29c1b50df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in karma-remark-meissa-quasarjet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24ba9b8f201e1838f0dfd5912cdccffa7d9283e7ef7d366a6fd932f1dc7a7ef6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loglevel-meteor-mui-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ca35c471536de6395cd1a455a18886f5a26d7919adfe6f44006c4879d894dfa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dagda-tectonophysics-materialize-astrometry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04d94becdcfffe52289f147971a2e0a66cae9cf2667f79896b09d344f352231c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mantle-private-mineralogy-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7a10c0e697099de5b3529186316ba2c99a82df570459a1161bb7f18e5ecc9f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-australis-inflation-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ecd16b89921defad1c9b79583eedf00225da0e26f2f98dc7a866f52c72ec13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in frontend-kuiperbelt-proteomics-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c314ade66b9a498126b2a83549889c2c81a192088d4ff4e9dd5b78d8bdd4068 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightwatch-ophiuchus-request-quito (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894e22879845ad696f15e64f90cbac43dcd710f450574a8380386811c09f27d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in development-kinetic-mocha-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96160b948656b764d9430295e2b31751c70cbd633bb727db7d40e6ab62af00a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in puppeteer-tailwindcss-karma-postcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9679267623f6c6b49f81c8f19e9f271e992336207668f965e6348a4c9bbf98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phi-private-async-earth-xi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b930c14e745c4ce4165a894796d9879c130ecb462db863194881e2488a88548 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cordelia-websockets-yakutsk-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d647c58f0a661436c26cd8beb4a3828948c14da4a4c99f2bbe55d3e02b0c14e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightmare-mesosphere-iota-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2277b8efd1d670698357ef4928cfdeebcbaf96d247814a668af92fe7f157f8e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...