Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI that is open source. Versions of Open WebUI prior to 0.8.0 had a cross-site scripting vulnerability. This vulnerability stemmed from the insecure preview of Excel file attachments. The specially crafted XLSX file paylo...

GHSA-HCWP-82G6-8WXC Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

Related advisory This advisory tracks a regression of the original Excel-preview XSS that was publicly disclosed and patched under GHSA-jwf8-pv5p-vhmc patched in v0.8.0. The same root cause — XLSX.utils.sheettohtml output rendered via @html excelHtml without DOMPurify — was reintroduced sometime...

SUSE CVE-2023-7101

Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution ACE vulnerability due to passing unvalidated input from a file into a string-type "eval". Specifically, the issue stems from the evaluation of...

Security Updates for Microsoft Excel Products C2R (May 2026)

The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. CVE-2026-40359 - Out-of-bounds read in Microsoft Office Excel allows an unauthoriz...

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages lies in their ability to exploit memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages relates to the ability to utilize memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2026-40360

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

CVE-2026-40359

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-40362

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

The vulnerability of Microsoft Excel, Microsoft Office, and Microsoft 365 Apps for Enterprise applications relates to reading beyond the buffer limit in memory, allowing an intruder to gain unauthorized access to protected information.

The vulnerability of Microsoft Excel, Microsoft Office, and Microsoft 365 Apps for Enterprise programs relates to reading data beyond the buffer memory limit. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2026-40902

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes method reads row numbers from XML attributes without validating them against the spreadsheet maximum row...

CVE-2026-40902 PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes method reads row numbers from XML attributes without validating them against the spreadsheet maximum row...

EUVD-2026-29644

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-29641

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-29642

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

CVE-2026-40362

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-40360

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

CVE-2026-40359

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-40362

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-40362 Microsoft Excel Remote Code Execution Vulnerability

...

CVE-2026-40362

Summary: CVE-2026-40362 is a heap-based buffer overflow in Microsoft Office Excel that allows a local attacker to execute code. The CVSS 3.1 vector indicates LOCAL attack, no privileges required, user interaction required, with a High impact on confidentiality, integrity, and availability (base s...