Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

SummaryAny authenticated user can overwrite any file's content by ID through the POST /api/v1/retrieval/process/files/batch endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via GET /api/v1/knowledge/id/files an...

Open WebUI has unauthorized deletion of knowledge files

SummaryAn access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base or is admin, but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from...

PYSEC-2026-2742 Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

Summary Any authenticated user can overwrite any file's content by ID through the POST /api/v1/retrieval/process/files/batch endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via GET /api/v1/knowledge/id/files a...

FastMCP OAuth Proxy token reuse across MCP servers

While testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for this MCP server, the token is issued for the baseurl passed to...

PYSEC-2026-2474 FastMCP OAuth Proxy token reuse across MCP servers

While testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for this MCP server, the token is issued for the baseurl passed to...

LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

ContextA Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializerpicklefallback=True. When...

PYSEC-2026-3140 Tensorflow vulnerable to Out-of-Bounds Read

Impact When the BaseCandidateSamplerOp function receives a value in trueclasses larger than rangemax, a heap oob vuln occurs. python tf.rawops.ThreadUnsafeUnigramCandidateSampler trueclasses=0x100000,1, numtrue = 2, numsampled = 2, unique = False, rangemax = 2, seed = 2, seed2 = 2 Patches We have...

CVE-2026-6847

Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary co...

Malicious Package

Overview prettier-plugin-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-10430 Malicious code in prettier-plugin-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e4c522699877c1eca1bb9c838a443e3c4bfa21950cf5c5b1d23182ae91a534e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in prettier-plugin-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e4c522699877c1eca1bb9c838a443e3c4bfa21950cf5c5b1d23182ae91a534e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10420 Malicious code in path-addon-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b383636076e2701a372675c281ee82463d97529ed7d8db027276aa8a8b68b966 path-addon-extend presents itself as a copy of Node's built-in path module. On module load, path.js issues an HTTPS GET to a base64-obscured URL that...

MAL-2026-10413 Malicious code in eth-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcc98bc680f3d0b8c6dcf396d9f2425a5153658259014384cedf82698413755b The published lib/index.js contains 60KB of obfuscated JavaScript appended after a copy of the legitimate web3.js web3-core-subscriptions module. On...

Malicious code in eth-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcc98bc680f3d0b8c6dcf396d9f2425a5153658259014384cedf82698413755b The published lib/index.js contains 60KB of obfuscated JavaScript appended after a copy of the legitimate web3.js web3-core-subscriptions module. On...

Vulnerabilities in Siemens SICORE

Siemens has identified vulnerabilities in the SICORE Base system, particularly in versions under V26.20. These vulnerabilities are located in several components of the CPCI85 and SICORE Base systems. One of these vulnerabilities allows an authenticated attacker to crash the web service through an...

Malicious Package

Overview dotnet-runtime-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in dotnet-runtime-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c10c75766303f8c3bf261487e341e537f103116026309006ab71d977aacdd235 The package's postinstall lifecycle script package.json line 7: "postinstall": "node install.js" runs install.js, which on Windows writes a PowerShel...

PT-2026-59344

IDOR: Retrieval API Bypasses Knowledge Base Access Controls Author: Andrew Orr Summary validate collection access PR 22109 checks the user-memory- and file- collection name prefixes but does not check knowledge base collections, which use raw UUIDs as collection names. Any authenticated user who...

AlmaLinux 8 : 389-ds:1.4 (ALSA-2026:36201)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36201 advisory. 389-ds-base: 389-ds-base: Heap buffer overflow in sasliorecv via padded SASL UNBIND CVE-2026-11610 389-ds-base: 389-ds-base: integer overflow in SASL...

PT-2026-59354

Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite Affected Component Retrieval web/YouTube processing endpoints: - backend/open webui/routers/retrieval.py lines 1810-1837, process web - backend/open webui/routers/retrieval.py the parallel process youtube endpoint ...