https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-02T05:45:48.859237+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-44549 CVE-2026-44549 — Open WebUI: Stored XSS in excel file preview 2026-10-02T05:45:48.869271+00:00

Affected: open-webui

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheet_to_html to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via @html causing the payload to trigger. This vulnerability is fixed in 0.8.0.