CVE-2026-87012 Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/openwebui/models/calendar.py stored the calendar event meta.alertminutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An...

CVE-2026-87012 Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/openwebui/models/calendar.py stored the calendar event meta.alertminutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An...

CVE-2026-87012

Open WebUI (a self-hosted AI platform) is affected in versions 0.9.0 through 0.11.1 by a type-validation flaw in backend/open_webui/models/calendar.py. The meta.alert_minutes field was stored without type validation while the shared upcoming-event scheduler compared it numerically. An authenticat...

CVE-2026-87012 Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/openwebui/models/calendar.py stored the calendar event meta.alertminutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An...

changedetection.io

Webサイトの変更を自動検出 — ウェブページの変更をリアルタイムで監視 Webサイトの更新を監視し、Discord、Email、Slack、Telegram、Webhookなどで通知を受け取れます。 ウェブページのコンテンツ変更を検出し、即座にアラートを受け取れます。 価格変更、コンテンツ編集、条件付き変更などの監視に最適です。 今すぐウェブページ変更監視を始めましょう。お時間がない方には、月額$8.99のサブスクリプション、プロキシ利用、サポートをご用意しています！ 、 他のWebサイト変更監視サービスより半額です！ Chromeブラウザ内蔵。...

CVE-2026-81662

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...

CVE-2026-81662 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...

CVE-2026-81662

Flowintel (versions ≥3.3.0 ) is vulnerable to Remote Code Execution via its alerts settings update endpoint. The root cause is improper handling of requester-supplied configuration keys: while values were normalized to Python literals, the keys themselves were injected directly into the source of...

EUVD-2026-66997

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...

CVE-2026-81662 Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...

Astra Linux – Vulnerability in Firefox and Thunderbird

When reusing existing popups, Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

Astra Linux – Vulnerability in Firefox and Thunderbird

By misusing a race in our notification code, an attacker could have forcibly hide notifications for pages that had received full-screen and pointer-lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

Astra Linux – Vulnerability in Firefox and Thunderbird

A bug in the interaction of popup notifications with WebAuthn makes it easier for attackers to trick users into granting permissions. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11...

Astra Linux – Vulnerability in Firefox

A website can prevent a user from exiting full-screen mode through alerts and prompts. This can lead to user confusion and potential spoofing attacks. This vulnerability affects Firefox versions earlier than 115...

Astra Linux – Vulnerability in Firefox

A website could have obscured the fullscreen notification by using an option element, introducing a delay through a costly computational process. This could have caused confusion among users and potentially led to spoofing attacks. This vulnerability affects Firefox versions earlier than 115...

Important: Red Hat Security Advisory: RHEL AI 3.3 RPM runtime CVE fix - aom

AIPCC Security Alerts identified CVEs in the 3.3 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

CVE-2026-16316 Malformed IEC 61850 Sampled Values frames cause partial denial of service in StationGuard

OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values SV frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traffic. The vulnerability does not affect...

MAL-2026-12831 Malicious code in bigops-alerts-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1ece35b981e6725d807e3bfe7da2bc7e2129bb49fa6f656866ace6f67079284 On require of bigops-alerts-widget, vendor.js selects a payload path based on process.platform and process.arch, downloads an opaque binary from one ...

Malicious code in bigops-alerts-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1ece35b981e6725d807e3bfe7da2bc7e2129bb49fa6f656866ace6f67079284 On require of bigops-alerts-widget, vendor.js selects a payload path based on process.platform and process.arch, downloads an opaque binary from one ...

Important: java-17-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11...