Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Summary A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery SSRF, potentially leaking sensitive server-side credentials. Technical Description When applications validate incoming URLs using t...

CVE-2026-88056

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

DEBIAN-CVE-2026-88056

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

CVE-2026-88056 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

CVE-2026-88013 rclone: http backend forwards custom/auth headers to a different host on redirect

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

EUVD-2026-75179

Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin...

Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Summary Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, a...

GHSA-JMC6-2WR8-H3WJ Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Summary Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, a...

EUVD-2026-75437

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...

PT-2026-89690

Summary A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery SSRF, potentially leaking sensitive server-side credentials. Technical Description When applications validate incoming URLs using t...

CVE-2026-87995

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy...

CVE-2026-87995

Open WebUI versions 0.8.11 through 0.11.1 are affected by a same-origin XSS vulnerability in PortPreview.svelte. The terminal port content is rendered in an iframe sandbox that includes both allow-scripts and allow-same-origin. Because the terminal proxy serves content from the Open WebUI origin,...

CVE-2026-87995 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy...

CVE-2026-87995 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy...

CVE-2026-87995 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy...

firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Audio/Video: Playback component...

firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Graphics: ImageLib component...

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Graphics: ImageLib component...

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...