漏洞公告

Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

Open WebUI has an LDAP Empty Password Authentication Bypass

Grav: Stored XSS via page title (data[header][title]) in admin panel

MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning

Bunsink has an SSRF bypass in `validate_webhook_url`

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

open-webui Vulnerable to Stored XSS via Model Description

Electerm users can run dangrous code through link or command line

Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor

Electerm's full process.env exposed to renderer via window.pre.env

Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click

Electerm runWidget has a path traversal that leads to arbitrary code execution

absinthe_plug Has a Cross-site Scripting vulnerability

dash-uploader has a directory traversal vulnerability

Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output

phpseclib guardrails needed on OID length

justhtml introduces denial-of-service hardening

bitcoinj has a ScriptExecution P2PKH/P2WPKH Verification Bypass

nhost has Session Persistence After Password Change

gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers

`potato-annotation` has a Project-Boundary Bypass