CVE-2026-87997: Authorization Bypass Through User-Controlled Key

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/openwebui/main.py copied a client-supplied folderid into a new chat without applying the folder write-access chec...

CVE-2026-87011: Asymmetric Resource Consumption (Amplification)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/openwebui/utils/oauth.py fetched the OIDC discovery document and signing keys before validating a submitted logout...

CVE-2026-71805: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...

PT-2026-88849

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

PT-2026-88792

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-49883

creationtimestamp| type| source ---|---|--- 2026-09-08 22:11:27+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv2243bjm22w 2026-09-09 22:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4l2fy3k422 2026-09-15 02:37:07+00:00| seen|...

CVE-2026-19232

creationtimestamp| type| source ---|---|--- 2026-09-08 22:11:02+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv223d3mah2j 2026-09-09 11:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv3htw4ckn2y 2026-09-10 09:18:55+00:00| seen|...

CVE-2026-69527

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:58+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:07:46+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:16:35+00:00|...

CVE-2026-69770

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:38+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:07:21+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:46:06+00:00|...

CVE-2026-69383

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:30+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:07:15+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:18:46+00:00|...

CVE-2026-69475

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:18+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:07:01+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:47:43+00:00|...

CVE-2026-69838

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:05+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:06:44+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:51:23+00:00|...

CVE-2026-69459

creationtimestamp| type| source ---|---|--- 2026-09-08 22:08:02+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:06:40+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:20:51+00:00|...

CVE-2026-69480

creationtimestamp| type| source ---|---|--- 2026-09-08 22:07:58+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:06:38+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:21:42+00:00|...

CVE-2026-69474

creationtimestamp| type| source ---|---|--- 2026-09-08 22:07:57+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:06:38+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:22:27+00:00|...

CVE-2026-69638

creationtimestamp| type| source ---|---|--- 2026-09-08 22:07:19+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:06:30+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:49:27+00:00|...

CVE-2026-68875

creationtimestamp| type| source ---|---|--- 2026-09-08 22:07:11+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:06:27+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 08:51:27+00:00|...

CVE-2026-68834

creationtimestamp| type| source ---|---|--- 2026-09-08 22:07:01+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:06:19+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 08:53:59+00:00|...

CVE-2026-69685

creationtimestamp| type| source ---|---|--- 2026-09-08 22:06:42+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:05:56+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:45:08+00:00|...

CVE-2026-72926

creationtimestamp| type| source ---|---|--- 2026-09-08 22:06:39+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:05:53+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 10:22:29+00:00|...