PYSEC-2026-2702 Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature

SSRF Bypass via IPv6/IPv4-mapped IPv6/IPv4-reserved-ranges in validateurl Summary validateurl in backend/openwebui/retrieval/web/utils.py calls validators.ipv6ip, private=True, but the validators library does NOT implement the private keyword for IPv6 — the call raises a ValidationError which is...

EUVD-2026-37856

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the Personal File Storage PFS module. In modules/pfs/inc/pfs.editfolder.php, the folder update action 'a=update' updates folder metadata title, description, public/gallery flags without calling cotcheckxg ...

MAL-2025-188847 Malicious code in procyon-planckscale-steganography-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39c4d37fbf13255886e12089e56f22b61d91b3bdf0777757e8525a23c2d66b5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190001 Malicious code in triton-radiant-epimetheus-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f37690579c85320317072d9cdc94e1053ebab4d6fe9f33c85656cc0bb9598f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miranda-borealis-nova-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dfceb96c2bb4d76d95411a0920184fcb12cc9d7aa77518302845bae0a3e6a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189735 Malicious code in sun-serialize-parse-validate-alert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b13920f3f0ca3140df6e86d32d1c7763b6f4bdfb166b23361ada1f3d12873e8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quark-eslint-config-materialize-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f14e76d31b688dacef1a496176a9ca1ea81b594b81b2373404d54a5de86a60df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-postcss-loader-bunyan-celeste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8535f78567524d8b9c6926e20120a445a55b1ab1f7a69b7db5f380940c2fd10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deimos-polaris-gridsome-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2d7daf5a58341775641235bf8ae1045625d4dfe06b3b0772252ddf9a2d15bd0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in css-minimizer-webpack-plugin-brane-saturnology-quito (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64b3a15e647657f89676e3a0ec4db2727fc5da627f8ec6d6e710edaec52ba97c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in shell-process-eta-star-omicron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22452f12649538003c7b3f323d58496d4832fd6041b5b40d946747191db26d06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186413 Malicious code in csrf-thermochronology-oscillation-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23992ff1d63ebb87f14b33af1af9f888a76886aea879d7893bbf8d971fb1fa92 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189269 Malicious code in rollup-plugin-chai-soap-terser-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 961e8a7cfffd287292e217d76e3379b062907280f409cf0ea9836155a60343e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-publish-wasat-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cb333963f806358968a273c2116974e640b3616d2d94f90aa813485152c384f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sigma-awk-abstract-error-kappa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69d501bf3234ac1bd75171ea127e1a4bda1473613eb110a0228aa8c4a668c5df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gridsome-slides-pipe-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d3041ecadbfa1b9ee20c448a9f21b65c9463e9e394b9f82d5a14402dab7ac41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webdriverio-wavefunction-publish-asteroid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dbd476dbd24f90f40965c0167d1e0e9d30a48c5075ce0ffa548800cfeaf17d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in typeorm-indus-restart-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59684f7e8948ef45ee9558fdd7a6b3e81cde5aac0835af604702b99536f71930 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sync-vega-apex-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7049cee782d42510430e26832fb304bb48636354de220eb85f797b763b0df0d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in debug-container-zeta-load-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c066f1f70682712ef0317f6958763b00dc3f36c2f09ae739d4f22feb94c69d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...