CyberRota
Back to database

CVE-2026-44721

HIGH · CVSS 7.3 EPSS 0.04% Public Exploit

Source: NVD + CISA KEV + EPSS · Published: 2026-05-15 · Last synced: 2026-06-09

CyberRota Analysis

Saldırganın giriş yapmış olması gerekebilir.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-44721
Severity
HIGH
CVSS
7.3
EPSS
0.04%
Java

Original NVD Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a stored cross-site scripting (XSS) vulnerability that allows any authenticated user with model creation permission (workspace.models) to execute arbitrary JavaScript in the browser of any other user (including admins) who views the malicious model in the chat UI. This vulnerability is fixed in 0.9.0.