CVE-2026-65937

CVE-2026-65937 affects WhatsUp Gold versions released before 2026.0.2. An authenticated attacker can bypass frontend controls and inject persistent script content via stored XSS vulnerabilities across the web UI. The CVSS3.1 score is 8.0 (HIGH) with adjacent attack vector, no privileges required,...

PT-2026-71154

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-31114 Fooocus webui vulnerable to Remote Code Execution

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of...

EUVD-2025-210684

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of...

PT-2026-70240

Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of...

GHSA-H7PC-VWP9-298G vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-horizon-2026.1...

agama-web-ui-23+75.1a877fb50-50.1 on GA media (moderate)

agama-web-ui-23+75.1a877fb50-50.1 on GA media Announcement ID: openSUSE-SU-2026:11472-1 Rating: moderate Cross-References: CVE-2026-13311 CVSS scores: CVE-2026-13311 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-13311 SUSE : 8.7...

GHSA-6HR6-W5QG-QMWG vulnerabilities

Vulnerabilities for packages: mitmproxy, open-webui, airflow...

EUVD-2026-54717

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write...

CVE-2026-71554 vulnerabilities

Vulnerabilities for packages: authentik, jupyter-all-spark-notebook, prefect-fips, mitmproxy, airflow, open-webui, localstack, apache-beam-python-3.14-sdk, authentik-fips...

CVE-2026-20311

Cisco IOS XE Software web-based management interface is affected. A vulnerability allows an authenticated, low-privilege remote attacker to trigger a reload (DoS) by exploiting insufficient error handling when authenticating with a malformed certificate. Impact is DoS with availability impact; at...

CVE-2026-70493

creationtimestamp| type| source ---|---|--- 2026-08-04 22:35:03+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-2f54-p244-32q6 2026-08-05 12:32:01+00:00| seen| https://gist.github.com/alon710/2d05301b2f45169422f4602c106418b3...

CVE-2026-70481

creationtimestamp| type| source ---|---|--- 2026-08-04 20:35:14+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-mj5r-jf49-m3w7...

CVE-2026-70483

creationtimestamp| type| source ---|---|--- 2026-08-04 20:35:09+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-3vf6-64vr-3g56...

CVE-2026-70487

Open WebUI (versions 0.8.8–0.11.0) allowed client-supplied knowledge attachments in an inline model to bypass read access checks, enabling any authenticated user who knows another user’s file id to retrieve indexed chunks from that file via builtin knowledge tools. This caused read-only cross-use...

CVE-2025-36431

IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.01 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2025-36298

IBM Sterling B2B Integrator and IBM Sterling File Gateway Ebics server components are vulnerable to cross-site scripting (CWE-79). Affected versions include B2Bi and File Gateway 6.1.2.0–6.1.2.7_2, 6.2.0.0–6.2.0.5_2, 6.2.1.0–6.2.1.1_2, and 6.2.2.0–6.2.2.0_1. The vulnerability allows an authentica...

EUVD-2025-210542

IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 Ebics server component is...

CVE-2025-36298 Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway

IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 Ebics server component is...

CLEANSTART-2026-NU98727 Security fixes in thingsboard-tb-web-ui 4.3.1.1-r1

Package thingsboard-tb-web-ui version 4.3.1.1-r1 fixes 10 vulnerabilities: CVE-2026-8723, CVE-2026-53655, CVE-2026-47759, CVE-2026-47761, CVE-2026-47762...