EUVD-2026-44628

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

CVE-2026-45314

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profileimageurl values, including data:image/svg+xml;base64,... payloads. The profile image endpoint then decodes and serves...

Ghost Cross-Site Scripting Vulnerability

Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. A cross-site scripting vulnerability exists in Ghost 5.76.0 and prior versions, which stems from the fact that an attacker can take over any account to interact with an...