Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
CVE-2026-87017
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built
#advisory
共收录 23661 条相关情报。
← 返回所有主题Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
CVE-2026-87016
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user
Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
CVE-2026-87015
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
CVE-2026-87014
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role sync
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
CVE-2026-87013
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /ap
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
CVE-2026-87012
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/o
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
CVE-2026-87011
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unaut
Rattler vulnerable to package cache path traversal via conda package build string
CVE-2026-53956
Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to versio
alf.io has Improper Access Control for Organization Owners that Exposes System Secrets
CVE-2026-50165
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Acc
NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
CVE-2026-54694
SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a s
【机器翻译】QPS调整与免费资源包下线通知
【机器翻译】QPS调整与免费资源包下线通知
【SSL证书】关于 DigiCert、GlobalSign、CFCA 及 TrustAsia 免费证书的根证书升级通知
【SSL证书】关于 DigiCert、GlobalSign、CFCA 及 TrustAsia 免费证书的根证书升级通知
【慧眼】人脸核身微信小程序开放电子认证类目通知
【慧眼】人脸核身微信小程序开放电子认证类目通知
【云数据库 MySQL】关于存储空间超用锁定规则及存储空间监控指标更新的公告
【云数据库 MySQL】关于存储空间超用锁定规则及存储空间监控指标更新的公告
【腾讯云认证】关于调整腾讯云AI从业者和云从业者认证类型的通知
【腾讯云认证】关于调整腾讯云AI从业者和云从业者认证类型的通知
Tanium addressed a server-side request forgery vulnerability in Enforce.
CVE-2026-87084
Tanium addressed a server-side request forgery vulnerability in Enforce.
Tanium addressed an unauthorized code execution vulnerability in Enforce.
CVE-2026-87088
Tanium addressed an unauthorized code execution vulnerability in Enforce.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-87048
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-87046
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-87073
Tanium addressed an improper access controls vulnerability in Comply.