Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
# Summary When a user signs in via OAuth, Open WebUI fetches the `picture` claim URL, infers a MIME type from the URL e
#severity:high
共收录 5513 条相关情报。
← 返回所有主题Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
CVE-2026-45401
# Server-Side Request Forgery (SSRF) Bypass via HTTP Redirect Following in Web-Fetch, Image-Load, and Chat-Completion En
Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
CVE-2026-45400
### Summary In the open-webui project, a parsing difference between the urlparse and requests libraries led to an SSRF b
Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
CVE-2026-45399
### Summary Any authenticated user with low privileges can enumerate active background tasks across the system and stop
Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
CVE-2026-45398
# IDOR: Retrieval API Bypasses Knowledge Base Access Controls **Author:** Andrew Orr ## Summary `_validate_collectio
Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a...
CVE-2026-46419
Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value i
Improper authorization checks of team members privileges allow a team member to escalate...
CVE-2026-32991
Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner ac
Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL...
CVE-2026-29206
Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the roo
Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint...
CVE-2026-32993
Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated a
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on...
CVE-2026-29205
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdav
SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server...
CVE-2026-32992
SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the
Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint...
CVE-2026-45229
Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows...
CVE-2026-8466
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows denial of service via unbo
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines...
CVE-2026-43970
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows unauthenticate
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard...
CVE-2026-33377
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have wr
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses...
CVE-2026-33376
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask expl
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x...
CVE-2026-21821
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly...
CVE-2026-0236
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its A
External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal...
CVE-2026-30905
External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11
Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and...
CVE-2026-33583
Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via a