CVE-2026-109300

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109300 Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109292 Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal...

CVE-2026-109292 Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal...

Sergio Brighenti XBackBone authorization issue vulnerability

Sergio Brighenti’s XBackBone 3.8.2 and earlier versions have an authorization issue. This vulnerability stems from a lack of authorization verification. Certified users can use the POST /upload/id/vanity route to change other users’ upload sharing codes. An attacker could provide consecutive uplo...

ProPhoenix Law Records Management Software has a security vulnerability

ProPhoenix Law Records Management Software 2022.2403.3.101 version has a security vulnerability. This vulnerability stems from the injection of a specially crafted 24-character string into the ASP.NETSessionId cookie, which may lead to session hijacking attacks...

WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability

Session Hijacking vulnerability discovered by Peter Tang in WordPress Plugin Broadcast Live Video versions = 7.3.2...

PT-2026-110786

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 4.19.1 Description An authentication bypass exists in the Login V2 UI. Unauthenticated attackers can obtain session tokens of other users by forging unsigned session cookies. By guessing time-ordered session IDs...

PT-2026-110769

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor descr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored...

PT-2026-110763

Name of the Vulnerable Software and Affected Versions better-auth versions 1.3.8-beta.3 through 1.7.0-rc.2 Description The deviceAuthorization plugin contains a UI misrepresentation issue. The endpoint 'GET /device' fails to display the requesting client id and scope. This allows an attacker to...

PT-2026-110717

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109300: Improper Neutralization of Input During Web Page Generation

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109292: Exposure of Sensitive Information to an Unauthorized Actor

Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal...

CVE-2026-109330: Missing Origin Validation in WebSockets

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page th...

CVE-2026-109352: Improper Neutralization of Input During Web Page Generation

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensordescr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored...

CVE-2026-84315: Missing Authorization

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

PT-2026-110747

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page th...

StableJudge: A Lightweight Adversarial Defense Framework for LLM-As-A-Judge

Large language models LLMs are increasingly used as judges to assign scalar scores that drive downstream decision-making, including tasks such as paper review and recommendation. However, LLM-as-a-Judge pipelines are vulnerable to score-hijacking prompt injection embedded in evaluated content,...

mitm6

mitm6 mitm6 es una herramienta de pentesting que explota la configuración predeterminada de Windows para tomar el control del servidor DNS predeterminado. Lo hace respondiendo a mensajes DHCPv6, proporcionando a las víctimas una dirección IPv6 de enlace local y estableciendo el host del atacante...

btlejack

BtleJack: una navaja suiza de Bluetooth Low Energy Btlejack proporciona todo lo que necesitas para esnifar, interferir y secuestrar dispositivos Bluetooth Low Energy. Se basa en uno o más dispositivos BBC Micro:Bit que ejecutan un firmware dedicado. También es posible que quieras usar un sniffer...