CVE-2026-26193 Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the embeds property on a response message, the content of which is loaded into an iFrame with a sandbox that has allow-scripts...

CVE-2026-26193 Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the embeds property on a response message, the content of which is loaded into an iFrame with a sandbox that has allow-scripts...

EUVD-2022-55927

H3C SSL VPN contains a user enumeration vulnerability that allows attackers to identify valid usernames through the 'txtUsrName' POST parameter. Attackers can submit different usernames to the loginsubmit.cgi endpoint and analyze response messages to distinguish between existing and non-existing...

CVE-2025-55179

Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen...

EUVD-2025-197992

Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen...

EUVD-2016-10549

Malware in sbrugna...

EUVD-2023-57827

Malicious code in bioql PyPI...

EUVD-2022-46985

Malicious code in bioql PyPI...

PT-2023-30673 · Kodbox · Kodbox

Name of the Vulnerable Software and Affected Versions: kodbox version 1.46.01 Description: The issue allows user enumeration, which is present on the login page. An attacker can identify valid users based on varying response messages, potentially paving the way for a brute force attack...

Qualcomm Chipsets 缓冲区错误漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that stems from a memory corruption issue when parsing QMI firmware response messages...

CVE-2022-44023

PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts...

CVE-2021-28662

An input validation flaw was found in Squid. This issue could allow a remote server to perform a denial of service against all clients using the proxy when delivering HTTP response messages. The highest threat from this vulnerability is to system availability. Mitigation Mitigation for this issue...

HaE - BurpSuite Highlighter And Extractor

HaE is used to highlight HTTP requests and extract information from HTTP response messages or request messages. Read Chinese simplified version READMEzh. Public Rules Website: https://gh0st.cn/HaE/ Introduction HaE is used to highlight HTTP requests and extract information from HTTP response...

HTTP Request Smuggling

squid3 is vulnerable to HTTP request smuggling. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches between a client and Squid with attacker-controlled content ...

CVE-2019-18678

An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches between a client and Squid with attacker-controlle...

CVE-2019-18678

An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches between a client and Squid with attacker-controlle...

PT-2018-18357

Name of the Vulnerable Software and Affected Versions: Huawei P20 versions prior to 8.1.0.171C00 Description: The issue arises from improper handling of response messages during certain inquiry operations, allowing an attacker to send crafted messages that could cause a denial of service conditio...

CVE-2016-9748: Exposure of Sensitive Information to an Unauthorized Actor

IBM Rational DOORS Next Generation 5.0 and 6.0 discloses sensitive information in error response messages that could be used for further attacks against the system...

Cisco IOS Software DNS Forwarder Denial of Service Vulnerability (cisco-sa-20160928-dns)

A vulnerability in the DNS forwarder functionality of Cisco IOS could allow an unauthenticated, remote attacker to cause the device to reload, corrupt the information present in the device SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced source...

Legal Robot: - Guessing registered users in legalrobot.com

Security researcher described a method to enumerate emails from the password reset page using brute force techniques. The response messages allowed a user to determine if an account existed. Furthermore, no rate limiting was applied...