•17 minutes ago•CVE-2026-71321
7.5CVE-2026-71321: Unauthenticated Denial of Service and CPU Exhaustion in Nuxt Island Renderer
An unauthenticated remote denial of service vulnerability exists in the Nuxt framework island renderer endpoint. By transmitting large or deeply nested JSON payloads, an attacker can block the single-threaded Node.js event loop, resulting in application-wide CPU exhaustion before signature verification occurs.
1 views•7 min read
•about 1 hour ago•CVE-2026-65601
5.3CVE-2026-65601: Namespace Confusion Vulnerability in Traefik Gateway API HTTPRoute BackendRef ExtensionRef Resolution
CVE-2026-65601 is a critical security vulnerability within Traefik's implementation of the Kubernetes Gateway API. Due to variable reuse and incorrect namespace resolution logic in the routing engine, Traefik resolved custom extension filters (such as Traefik CRD Middlewares) inside a target backend service's namespace rather than the originating HTTPRoute's namespace. This flaw enables a low-privileged tenant to bypass namespace isolation boundaries and invoke highly privileged middleware components in foreign namespaces to which they only have service-level routing access.
2 views•6 min read
•about 2 hours ago•CVE-2026-65602
5.3CVE-2026-65602: IngressRouteTCP ServersTransport Namespace Bypass in Traefik
An authorization bypass vulnerability in Traefik allows low-privileged users within unauthorized Kubernetes namespaces to reference privileged file-provider TCP serversTransports via IngressRouteTCP resources, bypassing the crossProviderNamespaces constraint.
2 views•7 min read
•about 3 hours ago•CVE-2026-71314
7.5CVE-2026-71314: Out-of-Memory Denial of Service via Unbounded v-for Expansion in Nuxt Server Islands
An unauthenticated remote denial of service (DoS) vulnerability exists in Nuxt's server component ('island') rendering mechanism. Due to a deterministic signature generation scheme and missing input constraints on server-side v-for directive expansion, an attacker can trigger unconstrained memory allocations on the hosting Node.js server, leading to immediate process crash.
3 views•6 min read
•about 4 hours ago•CVE-2026-70610
5.4CVE-2026-70610: Context Isolation Bypass via Prototype Pollution in Electron contextBridge
A security vulnerability in Electron's contextBridge allows untrusted renderer contexts to bypass context isolation. By passing an object with a crafted __proto__ property, an attacker can pollute the prototype chain of objects copied into the privileged preload context. This occurs because Electron's C++ property copying layer used standard V8 property assignment, which executes prototype setters. This bypasses Electron's context isolation security boundary, potentially enabling remote code execution (RCE) or privileges escalation. The vulnerability has been addressed in Electron versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.
3 views•5 min read
•about 5 hours ago•CVE-2026-70611
6.9CVE-2026-70611: Sandbox Escape and Command Execution via DevTools Shell Integration in Electron
A high-severity sandbox escape and arbitrary command execution vulnerability exists in the Electron desktop framework prior to versions 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3. The flaw lies in the handling of DevTools embedder messages during file manager reveal actions, allowing an attacker to execute arbitrary binaries with main process privileges.
4 views•6 min read
•about 6 hours ago•CVE-2026-70612
5.4CVE-2026-70612: Iframe Sandbox Escape and Host Protocol Launch in Electron
Improper access control in Electron versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 allowed sandboxed iframes to bypass sandbox restrictions and trigger external application protocols on the host operating system. The application's custom permission handler was also not provided with the frame's sandbox state, preventing effective validation of the request context.
4 views•6 min read
•about 7 hours ago•CVE-2026-70607
5.3CVE-2026-70607: Privileged Option Injection in Electron window.open Features
An input validation vulnerability in the Electron desktop framework allows untrusted web content running in a renderer process to inject privileged configuration options when creating child windows via window.open. Under Windows environments, this allows attackers to pass a remote Universal Naming Convention (UNC) path to the window icon configuration parameter, forcing the host system to make an SMB connection to a remote listener and leak the current user's NetNTLM authentication hash.
6 views•6 min read
•about 8 hours ago•CVE-2026-70604
7.4CVE-2026-70604: Cross-Origin Resource Sharing (CORS) Bypass in Electron Custom Schemes
Electron custom schemes registered with supportFetchAPI: true but without corsEnabled: true failed to apply CORS enforcement in versions prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0. This mapping discrepancy allowed malicious remote pages to issue cross-origin requests, read sensitive local response data, and bypass Same-Origin Policy (SOP) mechanisms.
5 views•6 min read
•about 10 hours ago•CVE-2026-70491
6.5CVE-2026-70491: Source Code Disclosure in Open WebUI Custom Tools
An information disclosure vulnerability in Open WebUI versions 0.10.2 and earlier allows authenticated non-admin users with read-only access (or any authenticated user when a tool is shared publicly) to retrieve the raw Python source code of custom workspace tools. Because these server-side tools commonly contain hardcoded API tokens, credentials, and proprietary logic, the exposure of raw tool source code severely compromises confidentiality and can facilitate wider infrastructure compromise.
7 views•5 min read
•about 11 hours ago•CVE-2026-70492
8.7CVE-2026-70492: Stored Cross-Site Scripting (XSS) via Unescaped KaTeX Render-Error Fallback in Open WebUI
CVE-2026-70492 (also tracked as GHSA-pwxh-7358-jq2x) is a stored Cross-Site Scripting (XSS) vulnerability in Open WebUI versions 0.10.0 through 0.10.x. The flaw arises because engine-level JavaScript stack overflow errors escape KaTeX standard error handling. Svelte's fallback rendering path assigns the raw, unescaped mathematical input string directly to the DOM using the unsafe {@html} directive, enabling arbitrary client-side code execution. This allows attackers to steal session tokens and perform unauthorized administrative actions when users view malicious messages. The vulnerability has been fully resolved in version 0.11.0.
4 views•10 min read
•about 12 hours ago•CVE-2026-70493
6.5CVE-2026-70493: Regular Expression Denial of Service (ReDoS) in Open WebUI Knowledge Search
CVE-2026-70493 is a critical Regular Expression Denial of Service (ReDoS) vulnerability affecting Open WebUI from version 0.9.6 up to (but excluding) 0.11.0. An authenticated user can submit a custom, highly complex regular expression pattern to search files within the knowledge base. Because these expressions are compiled and executed synchronously using Python's standard backtracking re module inside an asynchronous event loop, the server becomes unresponsive. A single request is capable of stalling the entire platform, denying access to all concurrent users of the system.
5 views•7 min read