CVE-2026-109307 Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a craft...

EUVD-2026-97609

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a craft...

CVE-2026-109307 Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a craft...

CVE-2026-109307

Craft CMS versions 5.0.0 before 5.10.14 are vulnerable to a DOM-based cross-site scripting (XSS) flaw within the control panel login and 2FA verification flow. The root cause is the improper handling of a user-controlled returnUrl parameter, which allows for the execution of javascript: URLs duri...

CVE-2026-109300

Open WebUI versions 0.6.31 through 0.11.4 are vulnerable to a stored cross-site scripting (XSS) flaw in the Markdown renderer . The root cause is that the renderer treats user-authored tool-call details blocks as tool output, mounting their embeds attribute in script-enabled iframes. An authentic...

CVE-2026-109300 Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109300 Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109291

Open WebUI versions 0.6.33 before 0.11.4 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly neutralize input, allowing authenticated users to store javascript: URLs within citation embed_url fields. An attacker can share a crafted chat where clic...

CVE-2026-109291 Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embedurl fields. Attackers can share a crafted chat whose citation, when clicked, is passed to...

CVE-2026-109291 Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embedurl fields. Attackers can share a crafted chat whose citation, when clicked, is passed to...

CVE-2026-109291 Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embedurl fields. Attackers can share a crafted chat whose citation, when clicked, is passed to...

CVE-2026-109290 Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-109290 Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-109290 Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-109290

Open WebUI versions 0.11.1 before 0.11.4 are susceptible to a stored cross-site scripting (XSS) vulnerability in the DocxPreview.svelte component. An authenticated attacker can execute arbitrary scripts by uploading a specially crafted DOCX attachment containing an OOXML altChunk HTML part or a s...

EUVD-2026-97592

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-109288 Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

EUVD-2026-97590

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

CVE-2026-109288 Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

CVE-2026-109288 Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...