Open WebUI is the morning, again. Seventeen advisories reached the advisory database on Tuesday, six of them high, and all of them fixed only in 0.11.0. Nine days ago this digest led with the eighteen-CVE batch that closed in 0.10.0 — and 0.10.x is the affected version in most of today's. Behind it, Electron picked up sixteen, which lands here because it's the shell under LM Studio, Cursor and the desktop clients you run rather than build.

Worth your morning

Open WebUI — seventeen more, and the only fix is a minor-version bump. Every advisory in the batch names 0.11.0 as the patched version and nothing in the 0.10.x line behind it. If you upgraded on July 26 because eighteen CVEs closed in 0.10.0, you are now on the affected version for most of these, and there is no 0.10.3 coming to catch you up.

The highest is CVE-2026-70492 (8.7), in the KaTeX renderer: when math failed to render, the fallback put the original source into the page as HTML instead of as escaped text. So the renderer escaped its output on the path where nothing went wrong. It reaches every message surface, including shared chats and channels, which means the viewer doesn't have to be the author. Session tokens live in localStorage, so the ceiling is account takeover including admin accounts. Affected 0.10.0 through 0.10.2.

Three more clear 8.0. CVE-2026-70486 (8.2) is the terminal's file-preview iframe carrying allow-same-origin, so a user with terminal access ran inside the application's own origin. CVE-2026-70482 (8.1) is the widest range in the batch — 0.8.0 forward — and the one to read if you use OAuth: the token exchange accepted access tokens issued to any client and returned a valid session for them. CVE-2026-70494 (8.1) is the odd one out, because it destroys rather than discloses: a collaborator with write access to a shared folder could permanently delete the owner's chat history in that folder and every subfolder under it.

Two are conditional and worth checking against your deployment rather than assuming. CVE-2026-70479 (7.7) only applies if the Playwright web loader is enabled, and then an authenticated user can read responses from services the browser process can reach, cloud metadata included. CVE-2026-70485 (7.1) needs a NAT64 gateway in the path to matter at all.

The ten moderates are where the batch gets its shape, and they rhyme: a check enforced on the documented route and absent from the one beside it. Tool source code returned to read-only users through the list and get endpoints (GHSA-3r7g-q6cg-q2vx). Image generation reachable through chat completions by users denied the image-generation permission (GHSA-g423-grf7-98rv). Cross-user file content surfacing through direct-model knowledge metadata (GHSA-6xhv-rxhv-pwm4).

One of them deserves naming on its own, because it breaks an assumption a lot of self-hosters are relying on: GHSA-5gpj-vj23-vhhv is that an unapproved account could open a terminal session through a WebSocket path that skipped the role check. If your Open WebUI is on the internet with open registration and admin approval as the gate, the approval queue was not the boundary. That's the thing to verify this morning, ahead of the upgrade itself: who can currently register, and what a pending account can reach. The bar for nearly everything in this batch is an authenticated account, and for several of them a low-privileged one.

Electron — sixteen, three high, and mostly not yours to patch. The batch went up as repo advisories on July 27 and reached the global database yesterday. The three highs: CVE-2026-70601 (7.5), a context-isolation bypass reaching the isolated preload world in applications that expose Promise-returning functions over contextBridge; CVE-2026-70604 (7.4), custom schemes registered with supportFetchAPI but not corsEnabled, which let a remote origin read full response bodies back; and GHSA-9f4c-93c8-jc8g, a sandboxed iframe getting past the allow-popups restriction. Fixed in 39.8.10, 40.9.3, 41.4.0 and 42.0.0 — take the top of whichever line you're on, since the earlier advisories in the same batch fix one patch lower.

If you ship an Electron app, that's a version bump. If you only use them, it isn't: the fix arrives when LM Studio, Cursor or your desktop client rebuilds against a patched runtime, and that lag is historically measured in weeks. The precondition on the two worth caring about is untrusted web content loaded in a renderer, which for an application that renders model output and fetches remote pages is not an exotic state. Nothing to do beyond knowing it's outstanding and checking your clients for updates rather than assuming they auto-caught it.

Standing items. The llama.cpp JSON-schema-to-grammar denial-of-service pair (CVE-2026-17500, CVE-2026-17501) is unpatched for a tenth day. PR #25308 last moved on August 3 and the disagreement there is now about whether the severities fit a project whose guidance is that llama-server shouldn't face untrusted networks — not about whether the fix is right. Keep schema input inside your trust boundary. Quiet on the Venicecom side: no high or critical for Angular, .NET, NuGet or Azure landed in the window, and the next Microsoft servicing release is Tuesday the 11th. primeng remains archived with no repository that can issue a security fix.

Outside the tracked stack but large enough to mention if you touch either: @nuxt/devtools took a 9.6 critical for unauthenticated command execution on the developer's own machine, fixed in 3.3.1, and rclone shipped fifteen advisories with four highs.