{"vulnerability": "cve-2026-4540", "sightings": [{"uuid": "a49072b5-aaa0-48be-8776-304d3f11e2c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-4540", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116272006923873264", "content": "", "creation_timestamp": "2026-03-22T09:00:28.939712Z"}, {"uuid": "350b8d53-284c-41e3-acba-d478417aaaed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-4540", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mhn6n7k7vc26", "content": "", "creation_timestamp": "2026-03-22T09:00:30.376447Z"}, {"uuid": "bf5d1d77-799c-48f5-ae23-d6c185ebb55d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4540", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mhna2zj7tg2h", "content": "", "creation_timestamp": "2026-03-22T09:26:06.972156Z"}, {"uuid": "926cb5e6-c6a5-41c5-afa4-535d622d5aa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4540", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhncjca7ot2e", "content": "", "creation_timestamp": "2026-03-22T10:09:53.618249Z"}, {"uuid": "c49fba4b-f9b0-4d59-b047-b4810db8e0e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-4540", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4540", "content": "", "creation_timestamp": "2026-03-22T07:15:59.000000Z"}, {"uuid": "ed186e88-f9e2-43db-bd2a-dfd72be16fdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45400", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mlxevxzuty2t", "content": "\ud83d\udfe0 CVE-2026-45400 - High (8.5)\n\nOpen WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-45400/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-16T08:04:11.744613Z"}, {"uuid": "d77f7520-8b27-4b94-9268-c8f238684d91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45400", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mm7hhn7dlj25", "content": "\ud83d\udccc CVE-2026-45400 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, a parsing difference between the ur... https://www.cyberhub.blog/cves/CVE-2026-45400", "creation_timestamp": "2026-05-19T13:07:10.482833Z"}, {"uuid": "0c8f78a6-ac69-403c-a1ec-e2c2f6a93e86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45409", "type": "seen", "source": "https://bsky.app/profile/releaseport.com/post/3mmnf6taznj27", "content": "Saleor 3.22.51 patches CVE-2026-45409\nCritical security vulnerabilities in JWT handling and IDNA processing are addressed,\nUpgrade carefully.\n\n\u2192 releaseport.com/r/saleor-saleor/3-22-51", "creation_timestamp": "2026-05-25T02:03:41.864176Z"}, {"uuid": "cca4f543-0b09-47a7-9aa2-dd260318754c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45409", "type": "seen", "source": "https://bsky.app/profile/releaseport.com/post/3mmnil4kweh2v", "content": "Saleor 3.23.7 patches CVE-2026-45409\nCritical security vulnerabilities in JWT handling and idna processing are patched,\nUpgrade carefully.\n\n\u2192 releaseport.com/r/saleor-saleor/3-23-7", "creation_timestamp": "2026-05-25T03:04:26.896487Z"}, {"uuid": "0db20ca1-2c48-40d9-9775-fd3f4896353a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45409", "type": "seen", "source": "https://bsky.app/profile/releaseport.com/post/3mmpovmoulr2j", "content": "Saleor 3.21.59 patches CVE-2026-45409\nEngineers benefit from critical PyJWT security patches and an idna update, enhancing JWT\nUpgrade carefully.\n\n\u2192 releaseport.com/r/saleor-saleor/3-21-59", "creation_timestamp": "2026-05-26T00:02:50.859665Z"}, {"uuid": "2b61019f-c88a-4bbc-85d4-dda6ea2a81c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45401", "type": "seen", "source": "https://t.me/GithubRedTeam/85934", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-45401\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a nayakchinmohan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-26 07:31:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWorking exploit for ssrf issue reported in CVE-2026\u201345401\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-26T08:00:06.000000Z"}, {"uuid": "5e312301-82e4-4481-acaa-66c1771e0de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-45401", "type": "published-proof-of-concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-rh5x-h6pp-cjj6", "content": "", "creation_timestamp": "2026-05-10T19:43:36.000000Z"}, {"uuid": "641c9eaf-7728-4f0a-89bd-5bb006264567", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-45402", "type": "published-proof-of-concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-r472-mw7m-967f", "content": "", "creation_timestamp": "2026-05-10T19:56:26.000000Z"}, {"uuid": "590554b5-12d6-4639-878a-2d8e9b9b807a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-45400", "type": "published-proof-of-concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-8w7q-q5jp-jvgx", "content": "", "creation_timestamp": "2026-05-10T19:37:59.000000Z"}, {"uuid": "ca59684b-b952-4ea6-b8e2-7731bd938ddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45401", "type": "seen", "source": "Telegram/IqAYll4ZzjxpeZQ_8CUvuT_fob3B5lJjEUBfv2EUXY56hck", "content": "", "creation_timestamp": "2026-05-27T21:12:27.000000Z"}, {"uuid": "dadb8f8e-3666-45a9-91da-30a7b279e1ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45409", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnlgica57p2y", "content": "CVE-2026-45409 - Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix\nCVE ID : CVE-2026-45409\n \n Published : June 5, 2026, 11:16 p.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : Internationalized Domain Nam...", "creation_timestamp": "2026-06-06T00:46:44.907977Z"}, {"uuid": "68020ac8-5b93-45ea-8fce-c5e804144642", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45406", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7kk7bms52n", "content": "CVE-2026-45406 - Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval\nCVE ID : CVE-2026-45406\n \n Published : June 26, 2026, 4:22 p.m. | 1\u00a0hour, 22\u00a0minutes ago\n \n Description : Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts ...", "creation_timestamp": "2026-06-26T18:17:50.304849Z"}, {"uuid": "e21aa45b-5124-4814-b6ff-7d4397a3ae95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45408", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7kmzy3za2c", "content": "CVE-2026-45408 - Dokku: OS Command Injection via App Name in Git Pre-Receive Hook\nCVE ID : CVE-2026-45408\n \n Published : June 26, 2026, 4:19 p.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9]...", "creation_timestamp": "2026-06-26T18:19:25.395483Z"}, {"uuid": "37aa3000-04fa-4217-9305-7fe373284907", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45405", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7m5luydh2c", "content": "CVE-2026-45405 - Dokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add\nCVE ID : CVE-2026-45405\n \n Published : June 26, 2026, 4:23 p.m. | 1\u00a0hour, 22\u00a0minutes ago\n \n Description : Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-arch...", "creation_timestamp": "2026-06-26T18:46:34.781114Z"}, {"uuid": "6e53b52d-1cf3-4e09-a4b5-e5b60fe3d620", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45407", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7mx6ctia2i", "content": "CVE-2026-45407 - Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch\nCVE ID : CVE-2026-45407\n \n Published : June 26, 2026, 4:21 p.m. | 1\u00a0hour, 23\u00a0minutes ago\n \n Description : Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command create...", "creation_timestamp": "2026-06-26T19:00:53.025222Z"}, {"uuid": "73df28a4-420b-4fff-bf90-62281a036548", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45408", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mpd7btxcpw2h", "content": "CVE-2026-45408 - Critical Command Injection in Dokku. CVSS 9.0. No patch available. Mitigations required. Limit git push access and review app name validation. #CVE #Dokku #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-45408/", "creation_timestamp": "2026-06-28T05:06:57.828397Z"}, {"uuid": "fa09ced8-04e3-4ce3-97dc-ea66066affde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45405", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mphphj2ody2g", "content": "\ud83d\udccc CVE-2026-45405 - Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary dir... https://www.cyberhub.blog/cves/CVE-2026-45405", "creation_timestamp": "2026-06-30T00:07:11.463990Z"}, {"uuid": "cf9829ac-30d0-4c45-8dce-ddf835a46083", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45406", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mphr55hvyv24", "content": "\ud83d\udccc CVE-2026-45406 - Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository direct... https://www.cyberhub.blog/cves/CVE-2026-45406", "creation_timestamp": "2026-06-30T00:37:06.617509Z"}, {"uuid": "61eea565-bc8e-462e-9320-2502a7d268b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-45408", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mphsssv2ny2e", "content": "\ud83d\udccc CVE-2026-45408 - Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex (^[a-z0-9][^/:_A-Z]*$) permits shell metacharacters. When an authentica... https://www.cyberhub.blog/cves/CVE-2026-45408", "creation_timestamp": "2026-06-30T01:07:07.269275Z"}]}