RHEL 10 : mod_http2 (RHSA-2026:50538)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:50538 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: modhttp2:...

CVE-2026-45705

OpenSIPS CVE-2026-45705 affects the SIP server in versions prior to 3.6.6 and 4.0.0-rc1. The vulnerability is a out-of-bounds read in the multipart body parser, caused by the find_line_delimiter() function reading beyond the logical end of the MIME boundary when it encounters a boundary near the ...

CVE-2026-45705

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...

DEBIAN-CVE-2026-67860

open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend...

CVE-2026-67860

open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend...

DEBIAN-CVE-2026-67857

open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray in src/client/uaclientconnect.c...

CVE-2026-67857

open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray in src/client/uaclientconnect.c...

CVE-2026-67857

A flaw was found in open62541. A remote attacker could exploit an out-of-bounds read vulnerability in the client-side function responseReadNamespacesArray by sending a specially crafted network packet. This could lead to a denial of service, causing the application to crash and become unavailable...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.11 Vulnerability Details CVEID:CVE-2020-28851 DESCRIPTION: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed to...

CVE-2026-70491

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70487

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file i...

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

GHSA-3R7G-Q6CG-Q2VX Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70491

Open WebUI vulnerability CVE-2026-70491 affects the self-hosted Open WebUI platform. In versions up to 0.10.2, the GET endpoints /api/v1/tools/, /api/v1/tools/list, and /api/v1/tools/id/{id} exposed full Python tool source to authenticated non-admin read-only users due to the interaction between ...

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Summary Open WebUI lets a client define a model inline on a chat request instead of selecting a saved workspace model. The knowledge attached to such an inline model was used as-is, without checking that the caller can read what it points at. Any authenticated user who knows another user's file i...

EUVD-2026-52808

A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMacProcessMsgDeleteMonitoredItemsResponse of the file src/ClientServer/frontend/clientwrapper/internal/statemachine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes...

CVE-2026-18790 Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds

A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMacProcessMsgDeleteMonitoredItemsResponse of the file src/ClientServer/frontend/clientwrapper/internal/statemachine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes...

CVE-2026-18790

Systerel S2OPC up to 1.7.3 contains a vulnerability in LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse (src/ClientServer/frontend/client_wrapper/internal/state_machine.c, DeleteMonitoredItemsRequest Handler). The flaw enables an out-of-bounds read and can be exploited locally. Public exploit...