CVE-2026-109291

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

October 13, 2026

Last Seen

October 13, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

CVE-2026-109291: Cross-Site Scripting Vulnerability in Open WebUI65.0

A cross-site scripting vulnerability (CVE-2026-109291) has been identified in Open WebUI versions 0.6.33 to 0.11.3, allowing authenticated users to execute scripts in victims' sessions. Attackers can store malicious 'javascript:' URLs in the embed_url field of chat citations, which, when clicked by...