PT-2026-76481

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

CVE-2026-70488

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

GHSA-JXC9-XMC4-GR23 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

CVE-2026-70488

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

CVE-2026-70488 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

CVE-2026-70488 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

EUVD-2026-52899

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

CVE-2026-70488

CVE-2026-70488 – Open WebUI : In Open WebUI builds from 0.9.6 to 0.11.0, the sync cleanup endpoint (POST /api/v1/knowledge/{id}/sync/cleanup) did not properly constrain actions to the target knowledge base. The handler authenticated write access via the URL knowledge base, then acted on directory...

CVE-2026-70488 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...

PT-2026-67926

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

allennlp (>=1.0.0rc6.dev20200604, <=1.1.0rc1.dev20200709), allennlp-models (>=1.0.0rc6, <=1.1.0rc1.dev20200709) +29 more potentially affected by CVE-2026-9856 via transformers (2.11.0)

transformers PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc6.dev20200604, =1.0.0rc6, =0.0.1rc1, =0.1.2, =0.1.3, =0.5.2, =0.1.2, =3.0.1, =0.1.0, =1.8.0, =0.12.2.dev2, =0.12.2.dev...

allennlp (>=2.8.0, <=2.9.0.dev20211215), allennlp-models (2.8.0) +8 more potentially affected by CVE-2026-9856 via transformers (4.12.5)

transformers PYPI version 4.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.8.0, =0.0.1rc158945962037, =0.1.2, =0.0.12, =0.0.0.116399031, =0.0.0.116461994 - transformers-embedder 1.8.2 Source cves:...

allennlp (>=2.5.1.dev20210625, <=2.6.0), allennlp-models (>=2.5.0.dev20210603, <=2.6.0) +16 more potentially affected by CVE-2026-9856 via transformers (4.8.2)

transformers PYPI version 4.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.5.1.dev20210625, =2.5.0.dev20210603, =0.0.1rc19, =0.1.5, =0.0.2, =0.0.4, =0.2.0, =0.12.3, =0.1.0, =0.1.1, =0.2.3, =0.2.0,...

CVE-2026-14133

A race flaw was found in the History Embeddings component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514039947...

ADVERSARIAL: And-Inverter Graph-Assisted Hardware Trojan Detection at Scale

Modern System-on-Chip SoCs often contain hundreds of millions to tens of billions of gates, making existing Hardware Trojan HT detection methods impractical due to their immense scale. The proposed approach incorporates symbolically enabled learning by modeling flattened gate-level netlists as...

clarinpl-embeddings (>=0.0.1rc158945962037, <=0.0.1rc158956732038) potentially affected by CVE-2026-66007 via datasets (1.16.1)

datasets PYPI version 1.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - clarinpl-embeddings =0.0.1rc158945962037, =0.0.1rc158956732038 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

clarinpl-embeddings (>=0.0.1rc19, <=0.0.1rc158803945536), sri-d3m (1.10.0) potentially affected by CVE-2026-66007 via datasets (1.6.1)

datasets PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - clarinpl-embeddings =0.0.1rc19, =0.0.1rc158803945536 - sri-d3m 1.10.0 Source cves: CVE-2026-66007 Source advisory: OSV:GHSA-379C-QX7V-6H59...

clarinpl-embeddings (>=0.0.1rc19, <=0.0.1rc158803945536), sri-d3m (1.10.0) potentially affected by CVE-2026-66007 via datasets (1.6.1)

datasets PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - clarinpl-embeddings =0.0.1rc19, =0.0.1rc158803945536 - sri-d3m 1.10.0 Source cves: CVE-2026-66007 Source advisory: OSV:PYSEC-2026-3716...

clarinpl-embeddings (>=0.0.1rc158945962037, <=0.0.1rc158956732038) potentially affected by CVE-2026-66007 via datasets (1.16.1)

datasets PYPI version 1.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - clarinpl-embeddings =0.0.1rc158945962037, =0.0.1rc158956732038 Source cves: CVE-2026-66007 Source advisory: OSV:PYSEC-2026-3716...