CVE-2026-102615

The HeyForm open-source form builder (prior to version 3.0.1 ) is vulnerable to stored XSS due to improper handling of uploaded files. The /api/upload endpoint accepts files based on client-controlled multipart file.mimetype while preserving HTML filenames. Consequently, the static/upload directo...

Open WebUI 0.1.105 File Upload / Path Traversal Vulnerabilities

Title: Open WebUI Arbitrary File Upload + Path Traversal Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-006.txt 1. Vulnerability Details Affected Vendor: Open WebUI Affected Product: Open WebUI Affected Version: 0.1.105 Platform: Debian 12 CWE Classification: CWE-22:...