23063 matches found
CVE-2026-54514
creationtimestamp| type| source ---|---|--- 2026-06-24 00:24:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moynnqc2bg23...
CVE-2026-56785
creationtimestamp| type| source ---|---|--- 2026-06-24 00:13:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moymzejeyd2t 2026-06-24 00:20:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyng2q77o2f...
PT-2026-52135
Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.31 Description Reflected Cross-Site Scripting XSS occurs in the JavaScript context of the 'auth profile.php' endpoint through the tab parameter. Reflected XSS is a type of attack where a malicious script is reflecte...
CVE-2026-54516
creationtimestamp| type| source ---|---|--- 2026-06-23 23:56:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moym3osjcc2s...
CVE-2020-9695
creationtimestamp| type| source ---|---|--- 2026-06-23 20:54:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moybvvwkbh2q...
CVE-2026-53753
creationtimestamp| type| source ---|---|--- 2026-06-23 20:39:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyb32agwx26 2026-06-24 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116802494595378111 2026-06-29 17:27:55+00:00| seen|...
CVE-2026-54324
creationtimestamp| type| source ---|---|--- 2026-06-23 20:31:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyamnmddw26...
CVE-2026-54321
creationtimestamp| type| source ---|---|--- 2026-06-23 20:28:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyagoino72a...
CVE-2026-54322
creationtimestamp| type| source ---|---|--- 2026-06-23 20:20:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7xvxbae2l...
CVE-2026-54323
creationtimestamp| type| source ---|---|--- 2026-06-23 20:11:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7ixesuo2r...
CVE-2026-54013
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no...
CVE-2026-54008
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backend/openwebui/utils/oauth.py::processpictureurl calls validateurlpictureurl on the initial URL only, then invokes aiohttp.ClientSession.getpictureurl, ... without...
CVE-2026-12957
creationtimestamp| type| source ---|---|--- 2026-06-23 17:54:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxxui6sh62t 2026-06-25 14:56:43+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mp4otnuzjr2v 2026-06-26 14:34:55+00:00| seen|...
CVE-2026-54299
creationtimestamp| type| source ---|---|--- 2026-06-23 17:03:44+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3moxuyx7ntw2f...
CVE-2026-54013
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no...
CVE-2026-54013 Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no...
CVE-2026-54013
CVE-2026-54013 describes a stored XSS in Open WebUI where the model profile image URL could be a data:image/svg+xml;base64 payload. The root cause is missing input validation on ModelMeta.profile_image_url and missing output protections in the model image endpoint (no MIME allowlist, no nosniff, ...
CVE-2026-54013 Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no...