octosuite

Terminal-based toolkit for GitHub data analysis. $ octosuite user torvalds from pprint import pprint import octosuite user = octosuite.Username="torvalds" exists, profile = user.exists if exists: pprintprofile Installation pip install octosuite Usage TUI Interactive Launch the interactive termina...

CVE-2026-108062

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

CVE-2026-108062

The CVE-2026-108062 vulnerability involves pre-authentication OIDC discovery and JWKS fetches running synchronously on the asyncio event loop . This synchronous execution causes a single unauthenticated request to stall the entire service, leading to a CWE-400 Uncontrolled Resource Consumption is...

CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

EUVD-2026-104908

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

PT-2026-118322

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

SummaryCVE-2026-48524 GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values DoS" was fixed in 2.13.0 by stopping fetchdata from clearing the cache on a fetch error. That closed one amplification path but did not add the mitigation the advisory's tit...

CVE-2026-101917 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...

GHSA-3G9Q-V48F-HH9W Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...

Allocation of Resources Without Limits or Throttling

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the POST /oauth/backchannel-logout process in the OIDC back-channel logout handler when unauthenticated requests trigger repeated network fetches f...

CVE-2026-79723

IBM Langflow OSS versions 1.0.0 through 1.11.5 allow a remote authenticated attacker to perform server-side request forgery (SSRF) via several connectors that skip the platform's shared SSRF validation guard. Affected components include the MCP server configuration URL field, the DataStax Astra D...

CVE-2026-79723 Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints...

CVE-2026-81213 Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...

CVE-2026-87058

A flaw was found in olm-operator-konflux-sample. The hermetic build mode is disabled by default, allowing bundle builds to perform live network fetches. This means that external, unverified resources can be pulled during the build process, potentially compromising the integrity and trustworthines...

PT-2026-89158

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An asymmetric resource consumption issue exists in the OIDC back-channel logout handler. When the ENABLE OAUTH BACKCHANNEL LOGOUT setting is enabled and an OIDC provider is configured, the...

EUVD-2026-53606

praisonaiagents vulnerable to SSRF in webcrawl tool via redirect-following and DNS rebinding validate-then-fetch gap...

Malicious code in dolyame-ui-sortablelist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c6a49e10172c9781161b964655fc6720e845ddf2049f0cfdbb39464946dbcd7 On require the package fetches a platform-specific executable from obfuscated Cloudflare Workers hosts oob-worker.cf100..3-.workers.dev, host strings...

Malicious code in dolyame-ui-popupcarousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d354604a4226c4f6847ce621402caf3b48115d1cbbaa52916d547f1337c38f6 On require of the package, support.js and lib/telemetry.js each fetch a platform-specific native binary from rotating anonymous Cloudflare Workers...