https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T21:42:35.782965+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-7044 CVE-2024-7044 — Stored XSS in open-webui/open-webui 2026-10-17T21:42:35.807060+00:00

Affected: open-webui/open-webui

A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.

 https://cve.radiocsirt.org/vuln/pysec-2026-1736 PYSEC-2026-1736 — Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload 2026-10-17T21:42:35.807122+00:00

Affected: PyPI: open-webui

A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.