CVE-2026-70480

Open WebUI prior to 0.11.0 renders Vega/Vega-Lite blocks in chat without restricted resource loading, enabling client-side SSRF: an attacker-blocked block can force the victim’s browser to issue attacker-controlled outbound GETs and read responses from same-origin or permissive CORS targets. Affe...

CVE-2025-58768: Improper Control of Generation of Code

DeepChat is a smart assistant uses artificial intelligence. Prior to version 0.3.5, in the Mermaid chart rendering component, there is a risky operation of directly using innerHTML to set user content. Therefore, any malicious content rendered via Mermaid will directly trigger the exploit chain,...

CVE-2016-4295

When opening a Hangul Hcell Document .cell and processing a particular record within the Workbook stream, an index miscalculation leading to a heap overlow can be made to occur in Hancom Office 2014. The vulnerability occurs when processing data for a formula used to render a chart via the...