CVE-2026-61667

creationtimestamp| type| source ---|---|--- 2026-07-13 18:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkebiubbw2v...

CVE-2026-59818

creationtimestamp| type| source ---|---|--- 2026-07-13 18:30:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd6gqmpf2w 2026-07-16 08:05:40+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrnye4md2p...

CVE-2026-55420

creationtimestamp| type| source ---|---|--- 2026-07-13 18:29:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd52uats2y 2026-07-16 08:05:31+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrnq77i22n...

CVE-2026-35211

creationtimestamp| type| source ---|---|--- 2026-07-13 18:26:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkcxnhopi2i...

CVE-2026-59245

creationtimestamp| type| source ---|---|--- 2026-07-13 17:53:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkb4bifd22w 2026-07-13 18:20:14+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqkcm5c5tr2t...

CVE-2026-0238

creationtimestamp| type| source ---|---|--- 2026-07-13 17:50:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkaxfclq42w 2026-07-16 08:04:05+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrl5x6vl2y...

CVE-2026-45579

creationtimestamp| type| source ---|---|--- 2026-07-13 17:42:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkahvtkce22...

CVE-2026-13243

creationtimestamp| type| source ---|---|--- 2026-07-13 17:38:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqkaasnkwj2f...

CVE-2026-13239

creationtimestamp| type| source ---|---|--- 2026-07-13 17:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqka56ugml2b...

CVE-2026-13237

creationtimestamp| type| source ---|---|--- 2026-07-13 17:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7zm334g2v...

CVE-2026-56460

creationtimestamp| type| source ---|---|--- 2026-07-13 16:10:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk3ejjgzx2x 2026-07-13 16:10:44+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqk3ekopta2m 2026-07-16 08:02:31+00:00| seen|...

PYSEC-2026-2757 Open WebUI: Stored XSS to Account Takeover via Model Profile Images

Stored XSS to Account Takeover via Model Profile Images in Open WebUI Affected: Open WebUI tags. On the output side, users.py added a MIME allowlist check and X-Content-Type-Options: nosniff. The fix was applied to UserUpdateForm, UpdateProfileForm, and later to ChannelWebhookForm. Three models...

PYSEC-2026-2426 compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

Summary The compliance-trestle library's profile import mechanism resolves trestle:// URIs and relative file paths by joining them with trestleroot and calling .resolve, but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a maliciou...

PYSEC-2026-2424 compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

Summary The compliance-trestle library's remote fetching cache mechanism HTTPSFetcher and SFTPFetcher constructs the local cache file path from the URL path component without sanitizing path traversal sequences ../. When a remote OSCAL profile references a URL with traversal in its path, the HTTP...

PYSEC-2026-2694 Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

As part of our research on improving our AI pentest, we have uncovered the following issue in Open WebUI. We've manually verified and tided up the report, but you can also find the original agent finding at the bottom of this report. Summary The channel webhook create/update flow accepts arbitrar...

PYSEC-2026-2738 Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation

Summary An application-wide Cross-Site Request Forgery CSRF vulnerability was found Open-WebUl's image uploading functionality. An attacker can set an image URL to a malicious endpoint, allowing them to perform actions on behalf of a victim user. Any authenticated user can exploit this...

PYSEC-2026-2708 Open WebUI has Stored Cross-Site Scripting In Profile Picture

Summary The profileimageurl field on the user profile update form accepted arbitrary data: URI values without MIME-type validation. Two distinct attack paths were independently demonstrated by separate reporters: 1. data:text/html;base64,... in a new browser tab raresvis, 2025-04-17 — when a vict...

CVE-2021-38135

creationtimestamp| type| source ---|---|--- 2026-07-13 13:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqjsrulk6w2k 2026-07-13 13:37:07+00:00| seen| https://bsky.app/profile/potato.software/post/3mqjsrvmvf22t...

CVE-2026-61983

creationtimestamp| type| source ---|---|--- 2026-07-13 13:33:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjskvppzu2i 2026-07-13 15:43:10+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqjztca5rv2j 2026-07-13 19:48:17+00:00| seen|...

CVE-2026-9820

creationtimestamp| type| source ---|---|--- 2026-07-13 12:43:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjprhnu3x2d 2026-07-13 12:43:12+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqjprhpk6o2o 2026-07-13 13:36:18+00:00| seen|...