PYSEC-2026-2702 Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature

SSRF Bypass via IPv6/IPv4-mapped IPv6/IPv4-reserved-ranges in validateurl Summary validateurl in backend/openwebui/retrieval/web/utils.py calls validators.ipv6ip, private=True, but the validators library does NOT implement the private keyword for IPv6 — the call raises a ValidationError which is...

EUVD-2026-37856

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the Personal File Storage PFS module. In modules/pfs/inc/pfs.editfolder.php, the folder update action 'a=update' updates folder metadata title, description, public/gallery flags without calling cotcheckxg ...

Malicious code in mongoose-supernova-transhumanism-gulp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f080f91fc223896f4b99c2ef315f355058984fd6c7ad8f2a112c9c4f169b8e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in private-easy-string-decrypt-meta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ae8f5ebf1c13bf1a1e8aa5ca2740eee87baa6e70ae9e6675a45d077559c16a9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-jest-sadr-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e89aac5d0b4009e332adde5f4ab68e22d2649dca304694ad146bbe8bd1ab922 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in typeorm-warp-procyon-non-blocking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ca2bddcca2cdd5d54a3bc5a9fccb0b9d6cece56e2654a5b6b065097d7536270 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phi-void-long-reject-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0575ba7190f457149e600c3f495b41bf3da1f88c362f42da78e7ded6e0d2b470 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in csv-puppeteer-phoenix-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 374bf3eeca6aa7f97f05cedd4268ceca21f16e8c36c450cb4fa2c17ac2ffd1ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nashira-winston-aurora-gatsby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9af5c52e6cf6987260607279112d0d054adf72f69bd5cad9cc62fec8cf109c67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upsilon-fast-epsilon-optimize-interface (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d653fcaa0c2e1a74b8bf8126b95ed3b9284be21d307f766a0df8c77a468db28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-plugin-markdown-lint-jest-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4732bbd796f8b60aa6eaaab2fad1af9c69bb1acc6c805e0ccc202d281754d20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loop-webdriverio-vulcan-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3f9d3f3f64e3dcfb01546c14df5e1d0e289308f7238bf5fb36f487b9e92423e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in test-meissa-stream-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e201ad4797f6c1d0adc706095b06d260333b5a1677e61717564549f492ee379a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in index-gamma-authorize-deploy-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 855a93e5306676df25469d50536f602165b1a8e5b59b3116fe63ffd6dba16314 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbra-jekyll-foundation-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c106822cf8e3fa26d502751c57e0f20c137335a06eaa078c6724cb7fa72d9938 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-config-angular-nodejs-carpo-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aff6171864c8dd888f734cabf61ae22f26f3868044dd59eb396032310cdbcf72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phi-private-async-earth-xi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b930c14e745c4ce4165a894796d9879c130ecb462db863194881e2488a88548 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in redgiant-nightwatch-filament-mensa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ed00d409000e536d8b0c2ac90de69f26c89dd68b20849ea28301e0b7896a5aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in markdown-dotenv-whitedwarf-decoherence (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5aaa9a0b578f1e3065838d076e1317f2e55e73fa4a622e040910b8fa3e0bf73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fusion-publish-query-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d512720b57f461578a656406e73eed2aa998862e62e2635a60b469de603a5928 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...