← All credits

Classic298

19 vulnerability records and advisories credit this contributor.

CVE-2026-109290

Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview

CVE-2026-109289

Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

CVE-2026-109288

Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

CVE-2026-109287

Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

CVE-2026-109286

Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal

CVE-2026-109285

Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

CVE-2026-109284

Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint

CVE-2026-109283

Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

CVE-2026-109300

Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds