109 matches found
CVE-2026-27628 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-24688 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-27025 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-996Q-PR4M-CVGQ vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-27205 vulnerabilities
Vulnerabilities for packages: airflow, emissary, open-webui, airflow-core, kubeflow-volumes-web-app, mlflow, mitmproxy...
CVE-2026-26013 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-23949 vulnerabilities
Vulnerabilities for packages: py3.9-setuptools, awx, label-studio, py3-cassandra-medusa, kubeflow-jupyter-web-app, pypy-3.11, text-generation-inference, tensorflow-gpu-jupyter, azure-functions-python-worker, kubeflow-katib, pypy-3.10, airflow, ansible-operator, datadog-agent,...
CVE-2026-22690 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-22691 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2025-68480 vulnerabilities
Vulnerabilities for packages: airflow, open-webui, ggshield...
GHSA-428G-F7CQ-PGP5 vulnerabilities
Vulnerabilities for packages: ggshield, airflow, py3-marshmallow, open-webui, airflow-core, superset...
CVE-2025-63391
An authentication bypass vulnerability exists in Open-WebUI =0.6.32 in the /api/config endpoint. The endpoint lacks proper authentication and authorization controls, exposing sensitive system configuration data to unauthenticated remote attackers...
CVE-2025-63391
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2025-63391
...
Exploit for CVE-2023-12345
Exploit-DB MCP Server for Pentesting A Model Context Protocol...
GHSA-9H52-P55H-VW2F vulnerabilities
Vulnerabilities for packages: semgrep, open-webui...
GHSA-9H52-P55H-VW2F vulnerabilities
Vulnerabilities for packages: open-webui, semgrep...
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'
Summary A Stored XSS vulnerability has been discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as...