Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

CVE-2026-11770

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

EUVD-2026-51510

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

Security update for bind (important)

openSUSE security update: security update for bind ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21489-1 Rating: important References: bsc1271982 bsc1271983 bsc1271984 bsc1271985 bsc1271986 bsc1271987 bsc1271988 bsc1271989 bsc1271990...

PT-2026-66736

Name of the Vulnerable Software and Affected Versions 389 Directory Server affected versions not specified Description An unauthenticated remote attacker can perform an LDAP filter injection within the CleanAllRUV replication status-check extended operation. The handler executes the search agains...

SUSE CVE-2026-46430

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort"", ":5553" resolves to ":5553"...

SUSE CVE-2026-54319

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference volumeId, which may also be a volume name was forwarded to the runner and used to build the host bind-mount source path without confinement. A...

CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

Security update for bind

This update for bind fixes the following issues: Upgrade to release 9.20.26. Security issues fixed: CVE-2026-10723: incorrect acceptance of NSEC3 records bsc1271982. CVE-2026-10822: key record using PRIVATEDNS algorithm may lead to unexpected exit bsc1271983. CVE-2026-11331: potential wildcard...

SUSE-SU-2026:3426-1 Security update for bind

This update for bind fixes the following issues: Upgrade to release 9.20.26. Security issues fixed: - CVE-2026-10723: incorrect acceptance of NSEC3 records bsc1271982. - CVE-2026-10822: key record using PRIVATEDNS algorithm may lead to unexpected exit bsc1271983. - CVE-2026-11331: potential...

CVE-2026-11331 affecting package bind for versions less than 9.20.26-1

CVE-2026-11331 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-11721 affecting package bind for versions less than 9.20.26-1

CVE-2026-11721 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-11622 affecting package bind for versions less than 9.20.26-1

CVE-2026-11622 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-13321 affecting package bind for versions less than 9.20.26-1

CVE-2026-13321 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-11605 affecting package bind for versions less than 9.20.26-1

CVE-2026-11605 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-12617 affecting package bind for versions less than 9.20.26-1

CVE-2026-12617 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-13204 affecting package bind for versions less than 9.20.26-1

CVE-2026-13204 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-10723 affecting package bind for versions less than 9.20.26-1

CVE-2026-10723 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-42306

A flaw was found in the Moby container framework. A race condition occurs during the docker cp mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could...