GHSA-MVX4-532P-XFM9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat Summary Open WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Pytho...

GHSA-4R2P-27MH-5M22 Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat Summary Open WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Pytho...

PT-2026-67585

Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...

PT-2026-67610

Summary The Budibase Worker service exposes a public, unauthenticated API endpoint GET /api/global/users/tenant/:id that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLIC ENDPOINTS list with a TODO comment acknowledging it...

PYSEC-2026-3542 vLLM has Remote DoS via Invalid Recovered Token Reinjection

Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reach...

arkindex-base-worker (>=0.2.1, <=0.3.0rc5), candyshop (>=0.2.0, <=0.2.2) +8 more potentially affected by CVE-2026-54552 via sh (1.14.2)

sh PYPI version 1.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on sh and may be impacted: - arkindex-base-worker =0.2.1, =0.2.0, =0.0.2, =4.3.0a1, =0.1.1.1, =1.0.1, =2.0.0rc3, =2.0.0rc4 Source cves: CVE-2026-54552 Source advisory: OSV:PYSEC-2026-3...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Service Worker mechanism in Google Chrome before version 148.0.7778.179 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML UXSS via a crafted Chrome Extension. Chromium security severity: Medium...

RHSA-2026:42946 Red Hat Security Advisory: rhc-worker-playbook security, bug fix, and enhancement update

Bulletin has no description...

CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

ALPINE-CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

AZL-92982 CVE-2026-50252 affecting package unbound for versions less than 1.25.2-1

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

EUVD-2026-47676

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

Important: Red Hat Security Advisory: rhc-worker-playbook security, bug fix, and enhancement update

An update for rhc-worker-playbook is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

SUSE CVE-2026-64162

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

abraia (>=0.8.0, <=0.8.9), arcor2 (>=0.19.0, <=0.21.0) +53 more potentially affected by CVE-2026-59197 via pillow (8.3.1)

pillow PYPI version 8.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - abraia =0.8.0, =0.19.0, =0.17.0, =0.12.0, =0.13.0, =2.0.0, =0.0.1, =3.0.0b34, =3.0.1b6 and more Source cves: CVE-2026-59197 Source advisory:...

3deecelltracker (0.5.0a0), aima (2023.2.4) +60 more potentially affected by CVE-2026-55379 via pillow (9.1.0)

pillow PYPI version 9.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3deecelltracker 0.5.0a0 - aima 2023.2.4 - an-website =22.5.13, =2.4.5, =0.2.4rc1, =22.14.1, =0.0.3, =1.0.1, =0.1.0, =0.0.36, =0.0.39 and more Source...