Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI that is open source. Versions of Open WebUI prior to 0.8.0 had a cross-site scripting vulnerability. This vulnerability stemmed from the insecure preview of Excel file attachments. The specially crafted XLSX file paylo...

GHSA-HCWP-82G6-8WXC Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

Related advisory This advisory tracks a regression of the original Excel-preview XSS that was publicly disclosed and patched under GHSA-jwf8-pv5p-vhmc patched in v0.8.0. The same root cause — XLSX.utils.sheettohtml output rendered via @html excelHtml without DOMPurify — was reintroduced sometime...

SUSE CVE-2023-7101

Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution ACE vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of...

Security Updates for Microsoft Excel Products C2R (May 2026)

The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. CVE-2026-40359 - Out-of-bounds read in Microsoft Office Excel allows an unauthoriz...

CVE-2026-40360

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

CVE-2026-40359

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-40362

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-40902

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes method reads row numbers from XML attributes without validating them against the spreadsheet maximum row...

CVE-2026-40902 PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes method reads row numbers from XML attributes without validating them against the spreadsheet maximum row...

EUVD-2026-29644

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-29641

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-29642

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

CVE-2026-40362

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-40359

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-40360

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

CVE-2026-40362

Summary: CVE-2026-40362 is a heap-based buffer overflow in Microsoft Office Excel that allows a local attacker to execute code. The CVSS 3.1 vector indicates LOCAL attack, no privileges required, user interaction required, with a High impact on confidentiality, integrity, and availability (base s...

CVE-2026-40362 Microsoft Excel Remote Code Execution Vulnerability

...

CVE-2026-40362

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-40362 Microsoft Excel Remote Code Execution Vulnerability

...

CVE-2026-40359

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...