PYSEC-2026-2702 Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature

SSRF Bypass via IPv6/IPv4-mapped IPv6/IPv4-reserved-ranges in validateurl Summary validateurl in backend/openwebui/retrieval/web/utils.py calls validators.ipv6ip, private=True, but the validators library does NOT implement the private keyword for IPv6 — the call raises a ValidationError which is...

EUVD-2026-37856

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the Personal File Storage PFS module. In modules/pfs/inc/pfs.editfolder.php, the folder update action 'a=update' updates folder metadata title, description, public/gallery flags without calling cotcheckxg ...

Malicious code in palynology-semantic-release-pulsar-wormhole (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34206c99211389792c4d934032f76e4292094dac40215fc8bc1353575dcefef7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enceladus-mdx-zenobia-blazar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99e2a80c789cff4acf26ba387580fde45a9aa60b2e20961dff463da98406a92d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vuepress-toml-magellan-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d73486af759f7bf45f85de2534aee0ca48048d4c03aafacd5b532d679496ef3e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bundle-theta-virtualize-sanitize-sigma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38282a1052c7793d90cc175a442afaee3305c74e477314e574480ced6a46e0a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zeta-permission-beta-short-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 150e97326cd1d07028267b635aa4429aa6fd26cd6649457e7a1bcf41e904538c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quick-serialize-small-bash-delta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83195472b40596bcbf33039302c5a9300ee72e68e9ab21557558e15d8f28a353 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in water-await-kappa-byte-minify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddac8211a085975ed1a27a1a6781daaf1224c8e6a0b1d8ab5d86e1876a0be703 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in import-benchmark-warn-node-catch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24561d64b8cda186bb2d88f82638fb3bbc75befb15a7a94728acd63a9b4ddfac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kinetic-iota-lint-palynology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c31c4d01babb265d54196beb69e8d0c534671f97f10feb2b96ba2106a7919c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miranda-borealis-nova-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dfceb96c2bb4d76d95411a0920184fcb12cc9d7aa77518302845bae0a3e6a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in glaciology-wormhole-cz-conventional-changelog-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a8e1427315241f9ca0e6b823c4472689c97f4ce67871133412359ec0964a80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quantum-uglify-js-acamar-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45ca996a0f37fec8bbeb92598671e30801501dc4df71a3dbf77130fec73874c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cordelia-cors-lyra-accretion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 644f7a8a9d15a00959af84e0feba9ed8c935a3bc1ad53d9607a84119e0769181 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xerxes-nuxtjs-enif-superposition (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3df68c1dbb342fe2e72f7fab9e48410d45a2321d9e4454632ee3c0f2b8aeda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in test-meissa-stream-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e201ad4797f6c1d0adc706095b06d260333b5a1677e61717564549f492ee379a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in superflare-on-nestjs-xanthus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4bc374df6bcd185907d9484f3b7435d95ad6326a7b1eba24209d2443c9e3479 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in geodynamo-callback-less-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c4458ad3238e5de7a67c222d870ebe2709d938149bc1b8763330abcf4a23e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quito-process-oscillation-nanotechnology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 305c655f081481854c69983ebaf4ee99e9246b7a2426a3c8e2665cdabb76619f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...