Skip to content

CVE record · 1 source

CVE-2026-109291

CVSS 7.3

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims'…

Vendor: Oracle
Product: java
CVSS: 7.3
Exposure class: AI infrastructure

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

15

CVE NVD 19d ago

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims'…

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can…

CVSS 7.3 CVE-2026-109291 Oracle