CVE-2026-56835

PraisonAI's Slack bot applies its configured "allowedusers", "allowedchannels", and unknown-user pairing policy in the normal Slack "message" event handler, but not in the adjacent Slack "appmention" event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is...

CVE-2026-4995 wandb OpenUI Window Message Event index.html cross site scripting

A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of the component Window Message Event Handler. This manipulation causes cross site scripting. The attack can be initiated remotely...

CVE-2026-4995: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of the component Window Message Event Handler. This manipulation causes cross site scripting. The attack can be initiated remotely...