PT-2026-52135

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.31 Description Reflected Cross-Site Scripting XSS occurs in the JavaScript context of the 'auth profile.php' endpoint through the tab parameter. Reflected XSS is a type of attack where a malicious script is reflecte...

CVE-2026-54516

creationtimestamp| type| source ---|---|--- 2026-06-23 23:56:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moym3osjcc2s...

CVE-2020-9695

creationtimestamp| type| source ---|---|--- 2026-06-23 20:54:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moybvvwkbh2q...

CVE-2026-53753

creationtimestamp| type| source ---|---|--- 2026-06-23 20:39:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyb32agwx26 2026-06-24 01:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116802494595378111 2026-06-29 17:27:55+00:00| seen|...

CVE-2026-54324

creationtimestamp| type| source ---|---|--- 2026-06-23 20:31:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyamnmddw26...

CVE-2026-54321

creationtimestamp| type| source ---|---|--- 2026-06-23 20:28:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyagoino72a...

CVE-2026-54322

creationtimestamp| type| source ---|---|--- 2026-06-23 20:20:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7xvxbae2l...

CVE-2026-54323

creationtimestamp| type| source ---|---|--- 2026-06-23 20:11:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7ixesuo2r...

CVE-2026-54013

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no...

CVE-2026-54008

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backend/openwebui/utils/oauth.py::processpictureurl calls validateurlpictureurl on the initial URL only, then invokes aiohttp.ClientSession.getpictureurl, ... without...

CVE-2026-12957

creationtimestamp| type| source ---|---|--- 2026-06-23 17:54:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxxui6sh62t 2026-06-25 14:56:43+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mp4otnuzjr2v 2026-06-26 14:34:55+00:00| seen|...

CVE-2026-54299

creationtimestamp| type| source ---|---|--- 2026-06-23 17:03:44+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3moxuyx7ntw2f...

CVE-2026-54013 Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no...

CVE-2026-54013

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no...

CVE-2026-54013

CVE-2026-54013 describes a stored XSS in Open WebUI where the model profile image URL could be a data:image/svg+xml;base64 payload. The root cause is missing input validation on ModelMeta.profile_image_url and missing output protections in the model image endpoint (no MIME allowlist, no nosniff, ...

CVE-2026-54013 Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no...

CVE-2026-35018

creationtimestamp| type| source ---|---|--- 2026-06-23 16:21:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxsmyk3dz2q...

CVE-2026-10609

creationtimestamp| type| source ---|---|--- 2026-06-23 16:01:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxrkfzp7i2a...

CVE-2025-71370

creationtimestamp| type| source ---|---|--- 2026-06-23 14:42:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxn3phlth2q...

CVE-2023-54365

creationtimestamp| type| source ---|---|--- 2026-06-23 14:37:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxmsqt73o2b 2026-07-13 16:02:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk2wiuhrz2z 2026-07-16 08:02:13+00:00| seen|...