CVE-2026-82107 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication...

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

EUVD-2026-75174

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication...

GHSA-P78M-89R6-PGF7 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

Insertion of Sensitive Information Into Sent Data

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the tool loading process. An attacker can gain unauthorized access to user session credentials by operating a tool server configured for bearer...

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...

EUVD-2026-75176

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite...

GHSA-WPMR-8H3Q-FWJ7 Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...

Improper Authentication

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Authentication in the getuserbyoauthsub or getuserbyscimexternalid process. An attacker can gain unauthorized access to another user's account, including administrator accounts, by supplying speciall...

n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

Impact The GitHub Trigger generated a signing secret when it registered a webhook and verified X-Hub-Signature-256 on each delivery. When GitHub answered the create request with a 422 because a webhook for the URL already existed, the node adopted the remote hook but kept only its id and events,...

NPM: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

NPM: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

GHSA-5M98-CGCR-XX3Q n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

Impact The GitHub Trigger generated a signing secret when it registered a webhook and verified X-Hub-Signature-256 on each delivery. When GitHub answered the create request with a 422 because a webhook for the URL already existed, the node adopted the remote hook but kept only its id and events,...

CVE-2026-88053

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATAINTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validati...

CVE-2026-88051

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and sizeused from a .traineddata model without a cap or an invariant check. reservereserved allocates the backin...

UBUNTU-CVE-2026-88053

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATAINTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validati...

CVE-2026-88050

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length but accepts negative code values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange in src/ccutil/unicharcompress.cpp can...

Open Redirect

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect in the GitLab pagination handling, which follows the URL given in a Link header and attaches the GitLab credentials to the next-page request without confining the follow to the original...

Open Redirect

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect via the Link header when following pagination links from a server response. An attacker can obtain configured credentials by manipulating the Link header to redirect requests to an...

Open Redirect

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect in the Docker registry pagination handling, which follows the URL given in an HTTP Link header while still attaching the registry credentials, without confining the follow to the original...

Open Redirect

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect in the process of handling pagination for NuGet registries via the HTTP Link header. An attacker can obtain registry credentials by configuring a malicious or compromised registry to suppl...