•37 minutes ago•CVE-2026-59215
3.1CVE-2026-59215: Insecure Direct Object Reference in Open WebUI Thread Message Lookup
A Broken Object Level Authorization (BOLA) / Insecure Direct Object Reference (IDOR) vulnerability in Open WebUI prior to v0.10.0 allows authenticated users to access and disclose private message contents, thread context, and channel metadata from other restricted private or Direct Message (DM) channels without proper authorization.
2 views•6 min read
•about 2 hours ago•CVE-2026-59222
6.5CVE-2026-59222: Sensitive Data Exposure in Open WebUI Channels API
Open WebUI versions starting from 0.7.0 up to, but excluding, 0.10.0 are vulnerable to a sensitive data exposure flaw in the channels API. The GET /api/v1/channels/{id}/members endpoint exposes full user database representations, including private API keys and webhook configurations. This allows authenticated users to extract private credentials of other members within the same channel.
5 views•4 min read
•about 3 hours ago•CVE-2026-59219
7.1CVE-2026-59219: Session Revocation Bypass in Open WebUI Real-Time Endpoints
CVE-2026-59219 identifies a session-revocation bypass vulnerability in Open WebUI versions 0.9.0 through 0.9.99. While standard HTTP REST endpoints enforce stateful JWT revocation using a Redis-backed blacklist, WebSocket and Socket.IO endpoints bypassed these checks. Consequently, a token revoked via sign-out or OIDC logout remains valid for establishing real-time communication channels and accessing server terminal proxies.
5 views•6 min read
•about 4 hours ago•CVE-2026-59864
9.3CVE-2026-59864: Critical Out-of-Package Local File Inclusion in Microsoft Kiota
CVE-2026-59864 is a critical path traversal vulnerability in Microsoft Kiota occurring when custom OpenAPI extensions specify a nested static template file. Lack of input sanitization allows malicious inputs to write directory traversal sequences directly into plugin manifests, causing out-of-package local file disclosure in downstream environments like Microsoft 365 Copilot.
6 views•7 min read
•about 19 hours ago•GHSA-X445-F3H2-J279
7.5GHSA-X445-F3H2-J279: OAuth Provider Confusion in Auth.js and NextAuth.js
A critical logical security flaw exists in Auth.js (formerly NextAuth.js) where signed anti-CSRF check cookies (state, nonce, and PKCE code_verifier) are not bound to the specific Identity Provider that initiated the authorization flow. In multi-provider environments, this allows an attacker to replay valid, cryptographically signed cookies minted during a flow with one provider against a callback handling a different provider. This vulnerability can lead to session hijacking, identity theft, or unauthorized account linking.
7 views•7 min read
•about 20 hours ago•GHSA-7RQJ-J65F-68WH
8.1GHSA-7RQJ-J65F-68WH: Account Takeover via Homoglyph Bypass in NextAuth.js Email Normalization
A security vulnerability in the email normalization logic of NextAuth.js and Auth.js allows remote attackers to bypass email validation constraints and achieve Account Takeover (ATO) through Unicode homoglyph smuggling. Under standard conditions, Unicode compatibility characters represent visually similar symbols that are normalized downstream to ASCII equivalents, facilitating structural validation bypasses. This issue specifically affects passwordless email authentication flows.
8 views•6 min read
•about 21 hours ago•GHSA-XMF8-CVQR-RFGJ
7.5GHSA-XMF8-CVQR-RFGJ: Denial of Service via Uncaught Exception and Session Confusion in Auth.js
Auth.js (formerly NextAuth.js) contains a denial of service vulnerability due to an uncaught URIError in the getToken() token parser when processing malformed percent-encoded sequences in bearer tokens. Additionally, the library was vulnerable to session state confusion and replay attacks because OAuth check cookies (state, nonce, and PKCE) were not properly bound to specific providers, permitting cross-provider token reuse.
6 views•6 min read
•about 22 hours ago•CVE-2026-53467
5.3CVE-2026-53467: Heap Information Disclosure via Uninitialized Pixel Cache in ImageMagick MNG Decoder
CVE-2026-53467 is a heap information disclosure vulnerability in the Multiple-image Network Graphics (MNG) decoder of ImageMagick. The vulnerability arises from a failure to zero-initialize newly allocated pixel cache memory buffers. A remote attacker can exploit this by submitting a crafted sparse MNG image file to trigger uninitialized memory preservation. The resulting output contains residual heap bytes, potentially leaking sensitive process memory or assisting in ASLR bypass.
7 views•6 min read
•about 23 hours ago•CVE-2026-55223
6.3CVE-2026-55223: Remote Code Execution via Deserialization Gadget Chain in c3p0 Connection Pooling Library
An untrusted deserialization vulnerability exists in the c3p0 JDBC connection pooling library before version 0.14.0. Standard JDBC getter methods conform to the JavaBean property getter pattern, allowing introspection libraries like Apache Commons BeanUtils to evaluate connection properties dynamically during deserialization, leading to arbitrary code execution when chained with a vulnerable database driver or JNDI sink.
6 views•6 min read
•about 24 hours ago•CVE-2026-54696
3.7CVE-2026-54696: Heap-based Buffer Overflow in Ruby json Gem Native C Extension
A heap-based buffer overflow vulnerability exists in the native C extension of the Ruby json gem (versions 2.9.0 through 2.19.8) during IO-based streaming serialization. An incorrect buffer size calculation can lead to memory corruption and process termination when processing large strings.
8 views•6 min read
•1 day ago•CVE-2026-59938
5.3CVE-2026-59938: Uncontrolled Memory Allocation (DoS) in pypdf Image Parsing
An uncontrolled memory allocation vulnerability (CWE-789) exists in pypdf prior to version 6.14.0. The library blindly trusted user-controlled image dimensions (/Width and /Height) from PDF metadata, allowing attackers to trigger physical memory exhaustion and an Out-of-Memory crash via tiny, malformed files.
5 views•8 min read
•1 day ago•CVE-2026-59936
8.7CVE-2026-59936: Infinite Loop in pypdf Inline Image Parser Leads to Denial of Service
An infinite loop vulnerability exists in the pure-python PDF library pypdf prior to version 6.14.1. This vulnerability occurs during the processing of malformed or truncated page content streams containing inline images. Specifically, the parser fails to validate the End-of-Stream condition during inline image dictionary parsing. This results in continuous backward stream-seeking and an infinite loop that consumes 100% CPU on the processing thread.
7 views•6 min read