PT-2026-59342

Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access Affected Component Socket.IO session state and role-check callsites: - backend/open webui/socket/main.py lines 330-351, connect handler — role snapshotted into SESSION POOL - backend/open webui/socket/main.py...

PT-2026-59336

Summary A Server-Side Request Forgery SSRF vulnerability exists in process picture url in backend/open webui/utils/oauth.py line 1338. The function fetches arbitrary URLs from OAuth picture claims without applying validate url, allowing an attacker to force the server to make HTTP requests to...

PT-2026-59360

CONFIDENTIAL KL-CAN-2024-002 Vulnerability Details | | Field | Value | |---|-------|-------| | 1 | Discoverer | Jaggar Henry & Sean Segreti of KoreLogic, Inc. | | 2 | Date Submitted | 2024.03.12 | | 3 | Title | Open WebUI Arbitrary File Upload + Path Traversal | | 5 | Affected Vendor | Open WebUI...

PT-2026-59558

Summary The table prefix configuration value is directly used to construct SQL table identifiers without validation. If an attacker controls this value, they can manipulate SQL query structure, leading to unauthorized data access e.g., reading internal SQLite tables such as sqlite master and...

PT-2026-59372

Summary The LDAP and OAuth authentication flows use a TOCTOU Time-of-Check-Time-of-Use pattern for first-user admin role assignment. The regular signup handler signup handler in auths.py, line 663 was explicitly patched to prevent this race with the comment "Insert with default role first to avoi...

PT-2026-58944

Summary Two filter-bypass techniques in NukeVietCoreRequest::filterAttr and NukeVietCoreRequest::unhtmlentities allow a low-privileged user any account with news post permission to store and serve arbitrary JavaScript to any visitor of the affected page. Affected Component...

PT-2026-59544

Summary The safe extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and call...

PT-2026-59630

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if parse content stream is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if th...

PT-2026-59580

Summary praisonaiagents resolves unresolved tool names against module globals and main after it fails to match the declared tool list and the registry. With the default agent configuration, perm allow is None, so undeclared non-dangerous tool names are not rejected by the permission gate. An...

PT-2026-59954

Impact If SparseFillEmptyRowsGrad is given empty inputs, TensorFlow will crash. python import tensorflow as tf tf.raw ops.SparseFillEmptyRowsGrad reverse index map=, grad values=, name=None Patches We have patched the issue in GitHub commit af4a6a3c8b95022c351edae94560acc61253a1b8. The fix will b...

PT-2026-59527

Summary The extractall function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0...

PT-2026-59921

Impact When TensorListFromTensor receives an element shape of a rank greater than one, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf arg 0=tf.random.uniformshape=6, 6, 2, dtype=tf.bfloat16, maxval=None arg 1=tf.random.uniformshape=6, 9, 1, 3,...

PT-2026-59311

Description MobSF's read sqlite function in mobsf/MobSF/utils.py lines 542-566 uses Python string formatting % to construct SQL queries with table names read from a SQLite database's sqlite master table. When a security analyst uses MobSF to analyze a malicious mobile application containing a...

PT-2026-59393

Cross-User File Access via Unchecked file id in Folder Knowledge and Knowledge-Base Attach Endpoints Summary Multiple endpoints accept a user-supplied file id and attach the referenced file to a resource the caller controls folder knowledge, knowledge-base contents without verifying that the call...

PT-2026-59230

Summary LangGraph's JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in tu...

PT-2026-59133

Impact An uncontrolled-resource-consumption memory exhaustion denial-of-service vulnerability CWE-400 / CWE-789. A client with push access could push a tiny crafted thin pack 174 bytes whose delta header declares a huge dest size. When dulwich ingested it via add thin pack / apply delta, it would...

PT-2026-59652

Summary PySpector versions = 0.1.6 are affected by a security validation bypass in the plugin system. The validate plugin code function in plugin system.py, performs static AST analysis to block dangerous API calls before a plugin is trusted and executed. However, the internal resolve name helper...

PT-2026-59356

Summary The ydoc:document:join Socket.IO handler checks note ownership only when the document id starts with note: colon. However, the YdocManager storage layer normalizes all document IDs by replacing colons with underscores document id.replace":", " ". An attacker can join a document room using...

PT-2026-59140

Summary fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. A remote HTTP clie...

PT-2026-59539

Summary PraisonAI's spider tools URL validation can be bypassed using alternate loopback host encodings. The affected component is: text praisonaiagents/tools/spider tools.py The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled...