Security advisories

medium2026-05-08

CVE-2026-44213-OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured

open-telemetry/opentelemetry-dotnet-contrib · GHSA-wfr5-454p-mjc2

medium2026-05-08

CVE-2026-44247-Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size

volcano-sh/volcano · GHSA-8wxp-xxp2-rcgx

critical2026-05-08

CVE-2026-44211-Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

cline/cline · GHSA-5c57-rqjx-35g2

high2026-05-08

CVE-2026-44209-banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI

masci/banks · GHSA-gphh-9q3h-jgpp

high2026-05-08

CVE-2026-44728-@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

babel/babel · GHSA-fv7c-fp4j-7gwp

high2026-05-08

CVE-2026-32689-Phoenix: Long-poll NDJSON body splitting causes large memory allocation

phoenixframework/phoenix · GHSA-628h-q48j-jr6q

medium2026-05-08

CVE-2026-44200-Wagtail has improper permission handling when copying pages

wagtail/wagtail · GHSA-67rv-mg8q-5pf3

medium2026-05-08

CVE-2026-44201-Wagtail has improper restriction handling on Documents and Images API

wagtail/wagtail · GHSA-p5gm-92h4-6pv6

medium2026-05-08

CVE-2026-44199-Wagtail has improper permission handling when deleting form submissions

wagtail/wagtail · GHSA-pwm3-7fv4-g6xx

medium2026-05-08

CVE-2026-44198-Wagtail has improper permission handling when viewing page history

wagtail/wagtail · GHSA-c4mr-889m-vgf6

medium2026-05-08

CVE-2026-44197-Wagtail has improper permission handling when comparing revisions

wagtail/wagtail · GHSA-c6wj-9vcj-75pj

medium2026-05-08

@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry

cdxgen/cdxgen · GHSA-qhh4-458h-xwh2

medium2026-05-08

CVE-2026-44560-Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search

open-webui/open-webui · GHSA-h36f-rqpx-j5wx

medium2026-05-08

CVE-2026-44561-Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

open-webui/open-webui · GHSA-hmgr-67hw-j2cq

medium2026-05-08

CVE-2026-44564-Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO

open-webui/open-webui · GHSA-vrfh-rj4q-rmhr

medium2026-05-08

CVE-2026-44563-Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

open-webui/open-webui · GHSA-rcvp-6fgw-c7fh

medium2026-05-08

CVE-2026-44562-Open WebUI's Model Import Overwrites Any Model Without Ownership Check

open-webui/open-webui · GHSA-mqq6-cqcx-38vg

medium2026-05-08

CVE-2026-44559-Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels

open-webui/open-webui · GHSA-c7wp-3qh5-55pv

medium2026-05-08

CVE-2026-44557-Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

open-webui/open-webui · GHSA-6c2x-gcp3-gp73

high2026-05-08

CVE-2026-44554-Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

open-webui/open-webui · GHSA-7r82-qhg4-6wvj