CVE-2026-4995Disclosure

LOWCVSS 2.0 · LOW

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of the component Window Message Event Handler. This manipulation causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

0.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-79CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-03-28: 3Technical Details · 2026-03-28: 103-28
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Full discourse3 posts
  • CVEarity@CVEarity
    Disclosure

    ⚡ New CVE Alert: CVE-2026-4995 📊 Severity: 3.5 🚨 Risk Level: Low 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4995 #CVE-2026-4995 #CVE #Low #CyberSecurity #InfoSec https://t.co/mXKHTfRFic

    Post summary

    The tweet announces the new CVE-2026-4995 with a low severity rating but provides no technical details, exploit code, or patch information.

    0000025
    123 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-4995 A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/index.html of… https://www.cve.org/CVERecord?id=CVE-2026-4995

    Post summary

    The text announces CVE-2026-4995 as a vulnerability in wandb OpenUI up to 1.0 affecting an unknown functionality in a specific file, but provides no additional technical details or evidence of exploitation.

    0000097
    56.9K followersView on X
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    Disclosure

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-4995 - wandb OpenUI Window Message Event index.html cross site scripting Intel Report: https://ift.tt/YDcKIi6

    Post summary

    CVE-2026-4995 is identified as a cross‑site scripting vulnerability in wandb OpenUI, with the threat reported but no proof‑of‑concept, active exploitation, or patch details provided.

    0000019
    283 followersView on X

Explore more