Skip to content

CVE record · 1 source

CVE-2026-109288

CVSS 6.4

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into…

Vendor: Oracle
Product: java
CVSS: 6.4
Exposure class: Developer platform, AI infrastructure

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

8

CVE NVD 19d ago

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into…

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed…

CVSS 6.4 CVE-2026-109288 Oracle