•about 1 hour ago•CVE-2026-70611
6.9CVE-2026-70611: Sandbox Escape and Command Execution via DevTools Shell Integration in Electron
A high-severity sandbox escape and arbitrary command execution vulnerability exists in the Electron desktop framework prior to versions 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3. The flaw lies in the handling of DevTools embedder messages during file manager reveal actions, allowing an attacker to execute arbitrary binaries with main process privileges.
1 views•6 min read
•about 2 hours ago•CVE-2026-70612
5.4CVE-2026-70612: Iframe Sandbox Escape and Host Protocol Launch in Electron
Improper access control in Electron versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 allowed sandboxed iframes to bypass sandbox restrictions and trigger external application protocols on the host operating system. The application's custom permission handler was also not provided with the frame's sandbox state, preventing effective validation of the request context.
3 views•6 min read
•about 3 hours ago•CVE-2026-70607
5.3CVE-2026-70607: Privileged Option Injection in Electron window.open Features
An input validation vulnerability in the Electron desktop framework allows untrusted web content running in a renderer process to inject privileged configuration options when creating child windows via window.open. Under Windows environments, this allows attackers to pass a remote Universal Naming Convention (UNC) path to the window icon configuration parameter, forcing the host system to make an SMB connection to a remote listener and leak the current user's NetNTLM authentication hash.
4 views•6 min read
•about 4 hours ago•CVE-2026-70604
7.4CVE-2026-70604: Cross-Origin Resource Sharing (CORS) Bypass in Electron Custom Schemes
Electron custom schemes registered with supportFetchAPI: true but without corsEnabled: true failed to apply CORS enforcement in versions prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0. This mapping discrepancy allowed malicious remote pages to issue cross-origin requests, read sensitive local response data, and bypass Same-Origin Policy (SOP) mechanisms.
4 views•6 min read
•about 6 hours ago•CVE-2026-70491
6.5CVE-2026-70491: Source Code Disclosure in Open WebUI Custom Tools
An information disclosure vulnerability in Open WebUI versions 0.10.2 and earlier allows authenticated non-admin users with read-only access (or any authenticated user when a tool is shared publicly) to retrieve the raw Python source code of custom workspace tools. Because these server-side tools commonly contain hardcoded API tokens, credentials, and proprietary logic, the exposure of raw tool source code severely compromises confidentiality and can facilitate wider infrastructure compromise.
6 views•5 min read
•about 7 hours ago•CVE-2026-70492
8.7CVE-2026-70492: Stored Cross-Site Scripting (XSS) via Unescaped KaTeX Render-Error Fallback in Open WebUI
CVE-2026-70492 (also tracked as GHSA-pwxh-7358-jq2x) is a stored Cross-Site Scripting (XSS) vulnerability in Open WebUI versions 0.10.0 through 0.10.x. The flaw arises because engine-level JavaScript stack overflow errors escape KaTeX standard error handling. Svelte's fallback rendering path assigns the raw, unescaped mathematical input string directly to the DOM using the unsafe {@html} directive, enabling arbitrary client-side code execution. This allows attackers to steal session tokens and perform unauthorized administrative actions when users view malicious messages. The vulnerability has been fully resolved in version 0.11.0.
3 views•10 min read
•about 8 hours ago•CVE-2026-70493
6.5CVE-2026-70493: Regular Expression Denial of Service (ReDoS) in Open WebUI Knowledge Search
CVE-2026-70493 is a critical Regular Expression Denial of Service (ReDoS) vulnerability affecting Open WebUI from version 0.9.6 up to (but excluding) 0.11.0. An authenticated user can submit a custom, highly complex regular expression pattern to search files within the knowledge base. Because these expressions are compiled and executed synchronously using Python's standard backtracking re module inside an asynchronous event loop, the server becomes unresponsive. A single request is capable of stalling the entire platform, denying access to all concurrent users of the system.
5 views•7 min read
•about 9 hours ago•CVE-2026-70588
5.0CVE-2026-70588: Stored Cross-Site Scripting via Universal Import in Ghost CMS
CVE-2026-70588 is a stored Cross-Site Scripting (XSS) vulnerability in Ghost CMS versions 5.26.0 through 6.54.0. The vulnerability exists within the Universal Import feature of the Ghost Admin interface. When processing imported content from third-party platforms such as Revue, the importer fails to sanitize user-controlled HTML tags, rich-text structured JSON, or link fields before rendering them in the Ghost Admin panel and front-end template rendering contexts.
8 views•7 min read
•about 10 hours ago•CVE-2026-53948
5.4CVE-2026-53948: Stored Cross-Site Scripting via File Upload Content-Type Spoofing in Ghost
CVE-2026-53948 is a stored cross-site scripting (XSS) vulnerability in the Ghost content management system. Affected versions (v6.19.4 up to v6.21.0) trusted the client-supplied Content-Type header during file uploads via the Admin API. This allowed authenticated attackers to upload benignly-named files with executable MIME types (like text/html), executing scripts in visitor browsers when hosted on integrated cloud platforms like S3 or GCS.
6 views•6 min read
•about 11 hours ago•CVE-2026-70589
4.8CVE-2026-70589: Improper Status Validation in Ghost CMS Offer Redemption
A business logic vulnerability in Ghost CMS allows unauthenticated remote users to redeem deactivated or archived promotional subscription offers by programmatically passing old offer identifiers during the checkout session initialization.
5 views•6 min read
•about 12 hours ago•CVE-2026-53944
5.8CVE-2026-53944: Server-Side Request Forgery Private IP Filtering Bypass in Ghost CMS
A Server-Side Request Forgery (SSRF) vulnerability exists in the Ghost content management system from version 6.0.9 up to, but not including, 6.21.1. The flaw resides in the 'request-external.js' module, where the IP address validation blocklist fails to account for fully expanded IPv4-mapped IPv6 formats. This allows unauthenticated remote attackers to bypass the private IP filter and initiate unauthorized connections to loopback services, internal subnets, or cloud instance metadata endpoints.
5 views•7 min read
•about 13 hours ago•CVE-2026-53945
4.0CVE-2026-53945: Time-of-Check to Time-of-Use (TOCTOU) DNS Rebinding Server-Side Request Forgery in Ghost CMS
Ghost CMS is vulnerable to Server-Side Request Forgery (SSRF) in versions 6.0.9 through 6.21.1. Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition in its outbound fetch validation logic, an attacker can bypass IP blocklists via DNS Rebinding. This allows unauthorized interaction with private networks and local services.
6 views•7 min read