Open WebUI missing authorization check at the model update function - models from other users can be updated

Summary A user can modify another user's model even if its visibility is set to Private. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here...

report-anonymizer

🛡️ Report Anonymizer Local LLM anonymizer for penetration-t...

WS-2019-0481

All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking...

WS-2019-0461

versions v1.0.0--v1.0.4 of only-test-not-install contain malicious code. The package deletes the folder /test from the system as a postinstall script...

PT-2026-41166

Name of the Vulnerable Software and Affected Versions CodeWhale versions 0.3.0 through 0.8.22 Description The run tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, allowing it to run without user approval. Because cargo test compiles and executes arbitrary...

Security Bulletin: DevOps Test Performance contains vulnerabilities related to use of Eclipse Jetty

Summary Due to use of Eclipse Jetty, DevOps Test Performance and Rational Performance Tester contain potential input validation, information exposure, integer overflow, memory allocation, HTTP parsing, and URI authority validation vulnerabilities. Vulnerability Details CVEID:CVE-2022-2047...

CVE-2026-42203

A flaw was found in LiteLLM, an AI Gateway. An authenticated user could exploit this by sending a crafted prompt template to the POST /prompts/test endpoint. The endpoint rendered user-supplied prompt templates without proper sandboxing. This could lead to arbitrary code execution within the...

CVE-2026-43685

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5...

CVE-2026-43685

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5...

CVE-2026-43685

A Remote Code Execution vulnerability exists in Claris FileMaker Cloud (versions prior to 2.22.0.5 ) due to improper neutralization of special elements in the External ODBC Data Source connection test feature. An attacker with Admin Console privileges can inject arbitrary operating system command...

CVE-2026-43685

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

com.github.jsimone:webapp-runner (8.5.9.0), com.github.obase:obase-test (>=0.5.0, <=0.7.0) +7 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.5.9)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.jsimone:webapp-runner 8.5.9.0 - com.github.obase:obase-test =0.5.0...

org.apache.tomcat.embed:tomcat-embed-jasper (8.5.21), org.apache.tomcat.embed:tomcat-embed-websocket (8.5.21) +3 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.21)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.21 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 8.5.21 -...

org.pidster:embed-apache-tomcat-core (0.1-alpha), org.pidster:embed-apache-tomcat-test (0.1-alpha) potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat (8.0.0-rc3)

org.apache.tomcat:tomcat MAVEN version 8.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - org.pidster:embed-apache-tomcat-core 0.1-alpha - org.pidster:embed-apache-tomcat-test 0.1-alpha Source cves...

org.pidster:embed-apache-tomcat-core (0.1-alpha), org.pidster:embed-apache-tomcat-test (0.1-alpha) potentially affected by CVE-2026-43512 via org.apache.tomcat:tomcat (8.0.0-rc3)

org.apache.tomcat:tomcat MAVEN version 8.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - org.pidster:embed-apache-tomcat-core 0.1-alpha - org.pidster:embed-apache-tomcat-test 0.1-alpha Source cves...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...

org.pidster:embed-apache-tomcat-core (0.2), org.pidster:embed-apache-tomcat-test (0.2) potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat (8.0.0-rc5)

org.apache.tomcat:tomcat MAVEN version 8.0.0-rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - org.pidster:embed-apache-tomcat-core 0.2 - org.pidster:embed-apache-tomcat-test 0.2 Source cves:...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.19), org.gatein.pc:pc-test-servers-tomcat7 (>=2.4.0.alpha03, <=2.5.1.final) +2 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (7.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.19 -...