CVE-2026-15361

The Content Views WordPress plugin (versions before 4.5 ) is vulnerable to SQL injection due to a lack of capability checks on an AJAX action and improper sanitization of attacker-supplied data in a SQL query. This allows any authenticated user , including those with Subscriber privileges, to per...

PT-2026-68864

Name of the Vulnerable Software and Affected Versions Content Views versions prior to 4.5 Description An issue exists where the plugin fails to perform a capability check on an AJAX action and does not properly sanitize data provided by the user before incorporating it into a SQL query. This allo...

CVE-2026-49391

CVE-2026-49391 affects Frappe framework’s Data Import feature. Before versions 16.19.0 and 15.109.0, imported column headers were not escaped when rendering previews/results, enabling an authenticated user to persist script content that executes when another user views the import interface (Store...

Important: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...

MAL-2026-13471 Malicious code in zyr-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6dd19313881a0bcfd90734ce897e3134af348bce2b7447eaf4e5dbc910f432c zyr-agent ships an AI coding agent whose default 'free' provider routes chat completions to a hardcoded preview-slug endpoint at...

Malicious code in zyr-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6dd19313881a0bcfd90734ce897e3134af348bce2b7447eaf4e5dbc910f432c zyr-agent ships an AI coding agent whose default 'free' provider routes chat completions to a hardcoded preview-slug endpoint at...

Important: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...

Important: Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image

A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running...

Malicious code in vitest-preview-pro-all (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7 package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavi...

MAL-2026-13405 Malicious code in vitest-preview-pro-all (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7 package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavi...

Important: Red Hat Security Advisory: RHTAS 1.4.3 - Tech Preview Release Of the Model Validation Operator

The Tech Preview release of the RHTAS Model Validation Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Model Validation Operator can be used with OpenShift Container Platform 4.16, 4.17,...

Important: Red Hat Security Advisory: RHTAS 1.4.3 - Tech Preview Release Of the Go based Model Transparency CLI

The Tech Preview release of the Go based RHTAS Model Transparency CLI image. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The Go based RHTAS Model Transparency CLI image can be used to sign and verify AI/M...

Malicious code in vitest-preview-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...

MAL-2026-12004 Malicious code in vitest-preview-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...

MAL-2026-11540 Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...

CVE-2026-70486

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

GHSA-3XPF-XQ7R-V8C5 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Summary Any authenticated user with access to a terminal server could get script of their choosing to run in the Open WebUI origin itself. The HTML file preview rendered terminal-served files in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, and the file is serv...

EUVD-2026-52893

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

CVE-2026-70486 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

CVE-2026-70486

Open WebUI (self-hosted AI platform) versions 0.9.0–0.11.0 contain a Same-Origin/XSS risk in the terminal file-preview iframe: the serveUrl iframe branch granted allow-same-origin and allow-scripts for HTML files from the app origin, enabling an authenticated user with terminal server access to r...