PYSEC-2026-3605 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Summary Any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through...

MiroTalk 安全漏洞

MiroTalk is a simple, secure, and fast real-time video conferencing software from the individual developer Miroslav Pejic. A security vulnerability exists in Mirotalk that stems from incorrect access control in the handleDataChannelChatdataMessage function...

Slack: Stored XSS in Channel Chat

Hi there is a stored XSS in Channel Chat feature. I strong believe this a critical stored XSS I've made a video as POC and Reproduction steps here: - https://www.dropbox.com/s/2opkr6ojsseo1ka/Slack-Chat-Stored-XSS.mov Thanks and Regards Prakhar Prasad...