Advisory Catalog

Wagtail has improper permission handling when comparing revisions

Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO

Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

Open WebUI's Model Import Overwrites Any Model Without Ownership Check

Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels

Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

Open WebUI's Channel Access Grants Bypass filter_allowed_access_grants

Open WebUI's responses passthrough endpoint lacks access control authorization

Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning

Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

Open WebUI has an LDAP Empty Password Authentication Bypass

Bunsink has an SSRF bypass in `validate_webhook_url`

open-webui Vulnerable to Stored XSS via Model Description

justhtml introduces denial-of-service hardening

`potato-annotation` has a Project-Boundary Bypass

dash-uploader has a directory traversal vulnerability

gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense

An issue in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, dash_uploader/upload.py in the Upload function and max_file_size parameter, dash_uploader/configure_upload.py components

PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`

PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute

PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection

utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables