GHSA-2QFP-Q593-8484 vulnerabilities

Vulnerabilities for packages: superset, pgadmin4, mitmproxy, nemo...

CVE-2025-62727 vulnerabilities

Vulnerabilities for packages: mlflow, open-webui, airflow, reflex, k8s-sidecar, kserve...

CVE-2025-62727 vulnerabilities

Vulnerabilities for packages: k8s-sidecar, airflow-core, mlflow, reflex, open-webui, airflow, kserve, nemo...

GHSA-PC6W-59FV-RH23 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2025-6984 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-JRHC-9QG9-4QFQ Open WebUI Allows Arbitrary File Reading and Deletion

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all...

PT-2024-38040

Name of the Vulnerable Software and Affected Versions open-webui version 0.3.8 Description An information disclosure issue exists related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists and provides different err...

PT-2026-39282

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.1.124 Description An issue exists in the self-hosted artificial intelligence platform where the application fails to validate or sanitize the filename during file uploads. When attaching files to a prompt via the...

New GobRAT Remote Access Trojan Targeting Linux Routers in Japan

Linux routers in Japan are the target of a new Golang remote access trojan RAT called GobRAT. "Initially, the attacker targets a router whose WEBUI is open to the public, executes scripts possibly by using vulnerabilities, and finally infects the GobRAT," the JPCERT Coordination Center JPCERT/CC...