漏洞公告

OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured

Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size

Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI

@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

Phoenix: Long-poll NDJSON body splitting causes large memory allocation

Wagtail has improper permission handling when copying pages

Wagtail has improper restriction handling on Documents and Images API

Wagtail has improper permission handling when deleting form submissions

Wagtail has improper permission handling when viewing page history

Wagtail has improper permission handling when comparing revisions

@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry

Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO

Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

Open WebUI's Model Import Overwrites Any Model Without Ownership Check

Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels

Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

Open WebUI's Channel Access Grants Bypass filter_allowed_access_grants

Open WebUI's responses passthrough endpoint lacks access control authorization

Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining