5378 matches found
CVE-2026-41313 vulnerabilities
Vulnerabilities for packages: nemo, open-webui, litellm...
CVE-2026-41182 vulnerabilities
Vulnerabilities for packages: kibana, librechat, open-webui, langfuse, langfuse-fips...
CVE-2026-42215 vulnerabilities
Vulnerabilities for packages: mlflow-fips, mlflow, open-webui, opal, datahub-ingestion-fips, awx, checkov...
CVE-2026-41314 vulnerabilities
Vulnerabilities for packages: open-webui...
Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display
Impact In the Prometheus server's legacy web UI enabled via the command-line flag --enable-feature=old-ui, the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics e.g. via a...
CVE-2026-44569
creationtimestamp| type| source ---|---|--- 2026-05-05 20:20:01+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jxwr-g6r6-j3fx...
CVE-2026-44566
creationtimestamp| type| source ---|---|--- 2026-05-05 15:44:20+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-9pgh-j74g-qj6m...
Google Chrome 安全漏洞
Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 148.0.7778.96 contained a security vulnerability. This vulnerability stemmed from insufficient execution of WebUI policies, which could allow remote attackers with access to the rendering process to bypass...
GHSA-RPFR-X88X-XWCW Pelican Web UI Affected by a Privilege Escalation Attack
Background On April 2nd, 2026, a Claude coding agent alerted Pelican PI Brian Bockelman to a privilege escalation vulnerability affecting Pelican's Web User Interface WebUI for various versions between v7.21 and v7.24. Upon further investigation, the Pelican team discovered this attack allows any...
DEBIAN-CVE-2026-42052
Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode for untrusted metadata fields. In this runtime, is raw insertion and HTML escaping is only performed by . Rendered output is then inserted with .html..., allowing...
Malicious Package
Overview @pyme-web/ui-widget is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview @pyme-web/ui-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-42052: Improper Neutralization of Input During Web Page Generation
Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode for untrusted metadata fields. In this runtime, is raw insertion and HTML escaping is only performed by . Rendered output is then inserted with .html..., allowing...
CVE-2026-3346 Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw
IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...
CVE-2026-3346: Improper Neutralization of Special Elements used in an SQL Command
IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...
GHSA-FV5P-P927-QMXR vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-FV5P-P927-QMXR vulnerabilities
Vulnerabilities for packages: open-webui, py3-langchain-text-splitters...
Malicious code in @pyme-web/ui-base (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6780882125fbf59796027cea605339595d23058e19a6a2a257637f225adb51e8 The package @pyme-web/ui-base was found to contain malicious code. Source: ghsa-malware...
MAL-2026-3118 Malicious code in @pyme-web/ui-base (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6780882125fbf59796027cea605339595d23058e19a6a2a257637f225adb51e8 The package @pyme-web/ui-base was found to contain malicious code. Source: ghsa-malware...
