7765 matches found
CVE-2026-70483
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort...
CVE-2026-70486
Open WebUI (self-hosted AI platform) versions 0.9.0–0.11.0 contain a Same-Origin/XSS risk in the terminal file-preview iframe: the serveUrl iframe branch granted allow-same-origin and allow-scripts for HTML files from the app origin, enabling an authenticated user with terminal server access to r...
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...
CVE-2026-70483
Open WebUI (self-hosted AI platform) contained an authorization bypass in the delete_chat_by_id handler (backend/open_webui/routers/chats.py) serving DELETE /api/v1/chats/{id}. The in-flight task cancellation was placed before ownership and permission checks, so any authenticated user with the de...
UBUNTU-CVE-2026-47781
PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...
CLSA-2026-1785380362 TuxCare security update for org.springframework.integration (1 CVE)
TuxCare rebuilt 43 org.springframework.integration packages to address 1 CVE. Fixed in 6.4.10-tuxcare.1...
CLSA-2026-1785291682 TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.21.4-tuxcare.3...
CLSA-2026-1785204577 TuxCare security update for 6 packages (1 CVE)
TuxCare rebuilt 6 packages to address 1 CVE. Fixed in 19.2.0-tuxcare.6...
CLSA-2026-1785291242 TuxCare security update for protobufjs (1 CVE)
TuxCare rebuilt protobufjs to address 1 CVE. Fixed in 5.0.0-tuxcare.1...
CLSA-2026-1784943203 TuxCare security update for dompurify (1 CVE)
TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.3-tuxcare.7...
CLSA-2026-1784769562 TuxCare security update for io.undertow (1 CVE)
TuxCare rebuilt 8 io.undertow packages to address 1 CVE. Fixed in 2.3.20.Final-tuxcare.1...
CLSA-2026-1784856319 TuxCare security update for 7 packages (2 CVEs)
TuxCare rebuilt 7 packages to address 2 CVEs. Fixed in 26.0.0-tuxcare.1...
CLSA-2026-1784856203 TuxCare security update for engine.io (2 CVEs)
TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 1.8.3-tuxcare.1...
CLSA-2026-1784856026 TuxCare security update for 13 packages (1 CVE)
TuxCare rebuilt 13 packages to address 1 CVE. Fixed in 2.18.1-tuxcare.3...
CLSA-2026-1784769564 TuxCare security update for angular (1 CVE)
TuxCare rebuilt angular to address 1 CVE. Fixed in 1.5.11-tuxcare.9...
CLSA-2026-1784683085 TuxCare security update for jsonwebtoken (1 CVE)
TuxCare rebuilt jsonwebtoken to address 1 CVE. Fixed in 0.3.0-tuxcare.1...
CLSA-2026-1784769536 TuxCare security update for 7 packages (2 CVEs)
TuxCare rebuilt 7 packages to address 2 CVEs. Fixed in 3.2.0-tuxcare.4...
CLSA-2026-1784682983 TuxCare security update for immutable (1 CVE)
TuxCare rebuilt immutable to address 1 CVE. Fixed in 5.0.3-tuxcare.2...