7479 matches found
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides whether a destination is allowed by asking whether its IP address is globally routable. That test operates on the literal IPv6 address and do...
CVE-2026-70483
CVE-2026-70483 (Open WebUI) affects Open WebUI versions 0.9.6 through 0.11.0. The DELETE /api/v1/chats/{id} endpoint could cancel a chat’s in-flight tasks (model response, title generation, or tag generation) without verifying the caller’s permission, enabling any authenticated user who knows ano...
CLSA-2026-1785291242 TuxCare security update for protobufjs (5 CVEs)
TuxCare rebuilt protobufjs to address 5 CVEs. Fixed in 5.0.0-tuxcare.1...
CLSA-2026-1785204577 TuxCare security update for 6 packages (1 CVE)
TuxCare rebuilt 6 packages to address 1 CVE. Fixed in 19.2.0-tuxcare.6...
CLSA-2026-1784943203 TuxCare security update for DOMPurify (1 CVE)
TuxCare rebuilt DOMPurify to address 1 CVE. Fixed in 2.4.3-tuxcare.7...
CLSA-2026-1784856203 TuxCare security update for engine.io (16 CVEs)
TuxCare rebuilt engine.io to address 16 CVEs. Fixed in 1.8.3-tuxcare.1...
CLSA-2026-1784683085 TuxCare security update for jsonwebtoken (17 CVEs)
TuxCare rebuilt jsonwebtoken to address 17 CVEs. Fixed in 0.3.0-tuxcare.1...
CLSA-2026-1784682983 TuxCare security update for immutable (1 CVE)
TuxCare rebuilt immutable to address 1 CVE. Fixed in 5.0.3-tuxcare.2...
CLSA-2026-1784682933 TuxCare security update for org.assertj (1 CVE)
TuxCare rebuilt 4 org.assertj packages to address 1 CVE. Fixed in 3.24.2-tuxcare.1...
CLSA-2026-1784596271 TuxCare security update for jquery (1 CVE)
TuxCare rebuilt jquery to address 1 CVE. Fixed in 3.1.1-tuxcare.1...
CLSA-2026-1784596292 TuxCare security update for js-yaml (5 CVEs)
TuxCare rebuilt js-yaml to address 5 CVEs. Fixed in 4.1.0-tuxcare.2...
CLSA-2026-1784164093 TuxCare security update for http-proxy-middleware (1 CVE)
TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.2-tuxcare.1...
CLSA-2026-1783991065 TuxCare security update for org.apache.kafka (2 CVEs)
TuxCare rebuilt 56 org.apache.kafka packages to address 2 CVEs. Fixed in 3.7.1-tuxcare.1...
CLSA-2026-1782262678 TuxCare security update for body-parser (1 CVE)
TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.2-tuxcare.1...
CLSA-2026-1780447836 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.39-tuxcare.12...
CLSA-2025-1761785337 TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 11.44.0-p1+tuxcare...
CLSA-2026-1778114660 TuxCare security update for @react-native-community (1 CVE)
TuxCare rebuilt 11 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.1...
CLSA-2026-1777250296 TuxCare security update for 35 packages (3 CVEs)
TuxCare rebuilt 35 packages to address 3 CVEs. Fixed in 8.5.100-tuxcare.9...