Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints
CVE-2026-45402
# Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints ## Summary Mult
#pip
共收录 834 条相关情报。
← 返回所有主题Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
# Summary When a user signs in via OAuth, Open WebUI fetches the `picture` claim URL, infers a MIME type from the URL e
Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
CVE-2026-45401
# Server-Side Request Forgery (SSRF) Bypass via HTTP Redirect Following in Web-Fetch, Image-Load, and Chat-Completion En
Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
CVE-2026-45400
### Summary In the open-webui project, a parsing difference between the urlparse and requests libraries led to an SSRF b
Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
CVE-2026-45399
### Summary Any authenticated user with low privileges can enumerate active background tasks across the system and stop
Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
CVE-2026-45398
# IDOR: Retrieval API Bypasses Knowledge Base Access Controls **Author:** Andrew Orr ## Summary `_validate_collectio
Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure
CVE-2026-45397
**Vulnerability Type:** Information Disclosure / Missing Authentication **Severity:** Medium **Component:** `backend
wger has an Uncontrolled Resource Consumption issue
### Summary Any authenticated user can create a routine spanning an arbitrarily long date range (e.g. 100 years) and th
Nautobot: GitRepository.current_head field should not be writable through REST API
CVE-2026-44798
### Impact A user with access to add/change a GitRepository record could use the REST API to directly set the `current_
Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
CVE-2026-44797
### Impact Nautobot's `Webhook` data model and associated feature set could be configured by users with sufficient acce
Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
CVE-2026-44796
### Impact Nautobot UI object-bulk-rename endpoints (for example, `/dcim/interfaces/rename/`) were vulnerable to applic
Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
CVE-2026-44794
### Impact In the case of inter-object references via `GenericForeignKey` (a pattern allowing an object to reference an
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
CVE-2026-45134
## Description The LangSmith SDK's prompt pull methods (`pull_prompt` / `pull_prompt_commit` in Python, `pullPrompt` /
Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect
CVE-2026-44681
### Summary An unauthenticated open redirect in Authlib's `OpenIDImplicitGrant` and `OpenIDHybridGrant` authorization e
UltraJSON has a Memory Leak in ujson.dump() on Write Failure
CVE-2026-44660
### Summary When `ujson.dump()` writes to a file-like object and the write operation raises an exception, the serialize
local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
CVE-2026-43979
## Summary `PDFService._markdown_to_html()` constructs an HTML document by interpolating user-controlled values — speci
Mistune Heading ID Attribute has Injection XSS
CVE-2026-44897
## Summary `HTMLRenderer.heading()` builds the opening `` tag by string-concatenating the `id` attribute value directly
Mistune has XSS via unescaped figclass/figwidth in Figure directive
CVE-2026-44896
In `src/mistune/directives/image.py`, the `render_figure()` function concatenates `figclass` and `figwidth` options dire
Mistune Math Plugin has an XSS Escape Bypass
CVE-2026-44708
## Summary The mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw use
GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
Summary The patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value().