Approved changes feed: RSS · Atom
cpe:2.3:a:wandb:openui:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Wandb (ef876b63-f793-5951-a3b0-34c9ab6afa9f) |
|---|---|
| Product | Openui (c7e4898f-f05c-501b-b68f-c8379485ca4e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-4995 |
vulnerable | 2026-06-08 08:07:02.767042 |
wandb OpenUI Window Message Event index.html cross site scripting
LOW (3.5)
A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of the component Window Message Event Handler. This manipulation causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-28T10:45:10.750Z
Updated: 2026-04-01T13:53:03.283Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4994 |
vulnerable | 2026-06-08 08:07:02.766587 |
wandb OpenUI APIStatusError server.py generic_exception_handler information exposure
LOW (3.5)
A vulnerability was found in wandb OpenUI up to 1.0/3.5-turb. Affected is the function generic_exception_handler of the file backend/openui/server.py of the component APIStatusError Handler. The manipulation of the argument key results in information exposure through error message. Access to the local network is required for this attack. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-28T09:15:12.348Z
Updated: 2026-03-30T17:41:13.509Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4993 |
vulnerable | 2026-06-08 08:07:02.766244 |
wandb OpenUI config.py hard-coded credentials
LOW (3.3)
A vulnerability has been found in wandb OpenUI up to 0.0.0.0/1.0. This impacts an unknown function of the file backend/openui/config.py. The manipulation of the argument LITELLM_MASTER_KEY leads to hard-coded credentials. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-28T09:15:09.765Z
Updated: 2026-03-30T15:44:20.422Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4992 |
vulnerable | 2026-06-08 08:07:02.765847 |
wandb OpenUI HTMLAnnotator server.py get_share HTML injection
MEDIUM (4.3)
A flaw has been found in wandb OpenUI up to 1.0. This affects the function create_share/get_share of the file backend/openui/server.py of the component HTMLAnnotator Component. Executing a manipulation of the argument ID can lead to HTML injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-27T22:03:46.340Z
Updated: 2026-03-30T14:53:55.953Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.