漏洞公告

Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)

Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar

NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint

NocoDB: Server-Side Request Forgery via Base Migration URL

NocoDB: Stored Cross-Site Scripting via Secure Attachment

NocoDB: Refresh Tokens Persist Through Password Recovery

NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL

vLLM: OOM Denial of Service via Audio Decompression Bomb

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services

Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory

n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints

Pi Agent: Pi loads project-local extensions without approval

Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts

Pi Agent: Race condition in Pi auth.json writes could expose stored credentials

Laravel Framework: Temporary Signed URL Path Confusion

Laravel Framework: CRLF injection in default email rule

Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass

Gitea: Token scope bypass on web archive download endpoint