PT-2026-89209

Description Before 1.22, if the Basic Auth htpasswd middleware was not configured, all incoming HTTP headers were blindly forwarded to the webhook script execution environment as shell variables. While the Basic Auth middleware correctly strips the authentication header X-WebAuthn-User from the...

PT-2026-89178

Summary Open WebUI protects server-side web fetches with two controls: the operator's list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any...

PT-2026-89097

A flaw was found in the OCAPI modules ocapi command, ocapi info of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an...

Security Advisory 0178

Security Advisory 0178 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added 1.2 | September 24, 2026 | Update regarding the workaround for resolution and target release versions for DMF...

Security Advisory 0173

Security Advisory 0173 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73455 CVSSv3.1 Base Score: 7.5...

Security Advisory 0172

Security Advisory 0172 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73438 CVSSv3.1 Base Score: 5.3...

Security Advisory 0182

Security Advisory 0182 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-86109 CVSSv3.1 Base Score: 6.6...

Security Advisory 0150

Security Advisory 0150 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added Description All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X...

Security Advisory 0151

Security Advisory 0151 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73451 CVSS:3.1 Base Score: 4.8...

Linux Distros Unpatched Vulnerability : CVE-2026-80914

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, a...

TencentOS Server 4: bouncycastle (TSSA-2026:0647)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0647 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

PT-2026-89177

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

CVE-2026-86766: Concurrent Execution using Shared Resource with Improper Synchronization

Snipe-IT versions up to and including 8.6.3 contain a race condition TOCTOU in the consumable checkout API endpoint POST /api/v1/consumables/consumableid/checkout. The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction...

Linux Distros Unpatched Vulnerability : CVE-2026-87872

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the OCAPI modules ocapicommand, ocapiinfo of the community.general Ansible collection. The shared OCAPI request helper disables TLS...

Security Advisory 0157

Security Advisory 0157 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added Description All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with the...

Security Advisory 0171

Security Advisory 0171 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73435 CVSSv3.1 Base Score: 8.2...

Security Advisory 0154

Security Advisory 0154 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73458 CVSSv3.1 Base Score: 8.2...

PT-2026-89089

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww mutex acquire in amdgpu devcoredump format When dumping IB contents from a hung job, amdgpu devcoredump format acquired the VM root PD's reservation via amdgpu vm lock by pasid and then, for each IB,...

PT-2026-89158

Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...

PT-2026-89173

Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...