CVE-2026-109286High· 8.1▾ TwilightOpen WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can sup…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77363High· 8.8obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
CVE-2026-109332Low· 3.1Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface
CVE-2026-9191Critical· 9.6Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state
CVE-2026-108268NoneEnclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation
CVE-2026-108269NoneRemote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections
CVE-2026-108267NonePrivasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls