py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size

CVE-2026-55195

py7zr's `Worker.decompress()` extracts archive entries without tracking total decompressed size. A crafted `.7z` file ca

历史摘要 · 未重新核验 · GitHub Advisory

VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files

### Summary vcrpy deserializes YAML cassette files with PyYAML's object-constructing loader (`yaml.CLoader` / `yaml.Loa

历史摘要 · 未重新核验 · GitHub Advisory

dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

CVE-2026-55837

## Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens ### Summary The local OAuth helper FastAPI server

历史摘要 · 未重新核验 · GitHub Advisory

Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser

## XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser ### Summary `ultimate-sitemap-parser` version 1.8.0 a

历史摘要 · 未重新核验 · GitHub Advisory

Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit

## Gzip Decompression Bomb Bypasses Sitemap Size Limit ### Summary `ultimate-sitemap-parser` enforces a 100 MiB size l

历史摘要 · 未重新核验 · GitHub Advisory

Crawl4AI: Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)

### Summary The Docker API server applied its SSRF destination check (`validate_url_destination`) on the non-streaming

历史摘要 · 未重新核验 · GitHub Advisory

Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

### Summary The Docker API server accepted a request-supplied `browser_config.extra_args`, which flowed into Chromium's

历史摘要 · 未重新核验 · GitHub Advisory

Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE

### Summary When the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input

历史摘要 · 未重新核验 · GitHub Advisory

netlicensing-mcp: REST Path Traversal Bypasses Token Redaction

## REST Path Traversal Bypasses Token Redaction in netlicensing-mcp ### Summary The `netlicensing_get_product` MCP too

历史摘要 · 未重新核验 · GitHub Advisory

Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

CVE-2026-55450

### Summary Unauthenticated users can upload any amount of data to the server without any limitations. No need for any p

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

CVE-2026-54022

### Summary The `ydoc:document:join` Socket.IO handler checks note ownership only when the `document_id` starts with `n

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

CVE-2026-54021

## Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied `url_idx` path parameter and us

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

CVE-2026-54019

# RAG ACL Bypass in Milvus Multitenancy Mode ## Summary This is a bypass of the fix for: - GHSA-h36f-rqpx-j5wx - CVE-

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

CVE-2026-54018

### Summary The SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP ad

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal

CVE-2026-54017

### Summary The terminal-server reverse proxy in `backend/open_webui/routers/terminals.py` does not fully confine the u

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

CVE-2026-54016

## Summary Open WebUI has a Broken Object Level Authorization (BOLA) vulnerability in the builtin `search_knowledge_fil

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

CVE-2026-54015

## Summary Open WebUI's prompt version-history endpoints authorize the `prompt_id` in the URL but then act on caller-su

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}

CVE-2026-54014

## Summary A path traversal vulnerability exists in open-webui's cache file serving endpoint that allows any authentica

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Stored XSS to Account Takeover via Model Profile Images

CVE-2026-54013

# Stored XSS to Account Takeover via Model Profile Images in Open WebUI **Affected:** Open WebUI ` tags. On the output

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

CVE-2026-54012

## Summary Open WebUI lets a user who can create, update, or import workspace models store arbitrary `meta.knowledge` e

历史摘要 · 未重新核验 · GitHub Advisory