CVE-2026-45314

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profileimageurl values, including data:image/svg+xml;base64,... payloads. The profile image endpoint then decodes and serves...

CVE-2026-44551

creationtimestamp| type| source ---|---|--- 2026-05-15 21:55:17+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mlwd4e4gaz2f 2026-05-16 11:01:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlxozn5c3m2n 2026-05-18 20:07:20+00:00| seen|...

CVE-2026-45299 Open WebUI: Stored Cross-Site Scripting In Profile Picture

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, the profileimageurl field on the user profile update form accepted arbitrary data: URI values without MIME-type validation, resulting in a XSS vulnerability. This vulnerability is...

CVE-2026-45314 Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profileimageurl values, including data:image/svg+xml;base64,... payloads. The profile image endpoint then decodes and serves...

GHSA-VFVV-C25P-M7MM

creationtimestamp| type| source ---|---|--- 2026-05-15 21:10:29+00:00| seen| https://gist.github.com/alon710/eb93d50b17daa578bcc910ffc0480f36...

GHSA-RC6V-5RMX-W5MV

creationtimestamp| type| source ---|---|--- 2026-05-15 20:40:29+00:00| seen| https://gist.github.com/alon710/7369a43661d2464459ab6b6fcb329366...

CVE-2026-42590

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.30.0, The ExifTool metadata write blocklist in Gotenberg can be bypassed using ExifTool's group-prefix syntax, enabling arbitrary file rename, move, hardlink, and symlink creation on the server. ExifTool supports group-prefix...

GHSA-MQ5J-PW29-JCV3

creationtimestamp| type| source ---|---|--- 2026-05-15 18:40:29+00:00| seen| https://gist.github.com/alon710/603dfdf0e01af88d7ae6413c9f3332fe...

EUVD-2026-30587

Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, collaborators.list, tables.metadata.list, explorations.list, and forms.list accept a databaseid without verifying that the requesting user was a collaborator on that...

CVE-2026-46508

creationtimestamp| type| source ---|---|--- 2026-05-15 18:01:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlvw2vm7au2p...

CVE-2026-37541

creationtimestamp| type| source ---|---|--- 2026-05-15 13:03:31+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mlvfespgwk2k 2026-05-20 16:07:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmcbyhnwol2r...

CVE-2026-41964

creationtimestamp| type| source ---|---|--- 2026-05-15 12:51:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlveq2tozv2c 2026-05-16 18:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlyghhkz3j2c...

CVE-2026-7563

creationtimestamp| type| source ---|---|--- 2026-05-15 12:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlvdnd5alz2s...

CVE-2026-4683

creationtimestamp| type| source ---|---|--- 2026-05-15 11:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlvabzkyk72a...

CVE-2026-43335

A flaw was found in the Linux kernel's interconnect driver for Qualcomm SM8450. The issue arises from unconverted dynamic IDs for platform interconnects, leading to a NULL pointer dereference in the icclinknodes function. This vulnerability can be triggered during runtime when a pointer to a...

CVE-2026-41961

creationtimestamp| type| source ---|---|--- 2026-05-15 11:17:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlv7ir2xip2i...

OESA-2026-2355 evolution-data-server security update

The evolution-data-server package provides a personal information management application that provides integrated mail, calendaring and address book functionality. The evolution-data-server package provides a single database for common, desktop-wide information, such as a user's address book or...

GHSA-WF8Q-WVV8-P8JF

creationtimestamp| type| source ---|---|--- 2026-05-15 08:10:29+00:00| seen| https://gist.github.com/alon710/db836de6fdadb3f6233ea8cd7bfaf4c5...

CVE-2026-6646

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dtdefaultbutton' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. This makes it...

CVE-2026-6646 The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dtdefaultbutton' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. This makes it...