Open WebUI: Cross-origin postMessage confirmation bypass via action:submit

Summary The chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthoriz...

CVE-2026-27429

creationtimestamp| type| source ---|---|--- 2026-06-17 14:10:14+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3moiij5wfno2b...

CVE-2026-49084

creationtimestamp| type| source ---|---|--- 2026-06-17 13:48:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moihcdx4732g...

CVE-2026-25470

Improper Control of Generation of Code 'Code Injection' vulnerability in ACPT ACPT Pro - Custom Post Types Plugin for WordPress allows Remote Code Inclusion. This issue affects ACPT Pro - Custom Post Types Plugin for WordPress: from n/a through 2.0.47...

CVE-2026-49068

creationtimestamp| type| source ---|---|--- 2026-06-17 13:00:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moiemgb6lj2c...

CVE-2026-46871

creationtimestamp| type| source ---|---|--- 2026-06-17 11:55:34+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moiayeen2k2g...

CVE-2026-46815

creationtimestamp| type| source ---|---|--- 2026-06-17 11:55:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moiaxrr3n52v...

CVE-2026-28575

creationtimestamp| type| source ---|---|--- 2026-06-17 10:01:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moi2kk2oaa2f 2026-06-21 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities20260622 2026-06-21 21:00:00+00:00| seen|...

CVE-2026-0071

creationtimestamp| type| source ---|---|--- 2026-06-17 09:45:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohzpnnet62z 2026-06-21 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities20260622 2026-06-21 21:00:00+00:00| seen|...

CVE-2026-0064

creationtimestamp| type| source ---|---|--- 2026-06-17 09:40:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohzgogkdh2j 2026-06-21 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities20260622 2026-06-21 21:00:00+00:00| seen|...

CVE-2026-0068

creationtimestamp| type| source ---|---|--- 2026-06-17 09:36:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohz6ybpqf2j 2026-06-21 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities20260622 2026-06-21 21:00:00+00:00| seen|...

CVE-2026-0082

creationtimestamp| type| source ---|---|--- 2026-06-17 09:20:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohydjy5ah2v 2026-06-21 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities20260622...

CVE-2026-8494 Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-12305

creationtimestamp| type| source ---|---|--- 2026-06-17 06:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mohn53qz2h27 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...

CVE-2026-35301

creationtimestamp| type| source ---|---|--- 2026-06-17 05:31:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-8 2026-06-17 11:55:09+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moiaxlbtai25 2026-06-18 18:07:08+00:00| seen|...

CVE-2026-46873

creationtimestamp| type| source ---|---|--- 2026-06-17 05:31:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-8 2026-06-17 11:55:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moiaxrr3n52v...

CVE-2026-35292

creationtimestamp| type| source ---|---|--- 2026-06-17 05:31:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-8 2026-06-17 11:55:09+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moiaxlbtai25 2026-06-18 18:37:07+00:00| seen|...

CVE-2026-46849

creationtimestamp| type| source ---|---|--- 2026-06-17 05:31:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-8 2026-06-17 11:55:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moiay72kk22v 2026-07-23 13:07:07+00:00| seen|...

CVE-2026-35311

creationtimestamp| type| source ---|---|--- 2026-06-17 05:31:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-8 2026-06-17 11:55:10+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moiaxlbtai25...

CVE-2026-35275

creationtimestamp| type| source ---|---|--- 2026-06-17 05:31:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-8 2026-06-17 11:55:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3moiaxrr3n52v...