Skip to content

CVE record · 1 source

CVE-2026-109300

CVSS 4.6

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored…

Vendor: Oracle
Product: java
CVSS: 4.6
Exposure class: AI infrastructure

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

8

CVE NVD 19d ago

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored…

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in…

CVSS 4.6 CVE-2026-109300 Oracle