420 matches found
CVE-2026-27025 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-996Q-PR4M-CVGQ vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-27205 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, open-webui, airflow-core, airflow, mlflow, mitmproxy, emissary...
CVE-2026-26013 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-23949 vulnerabilities
Vulnerabilities for packages: localstack, awx, py3.9-setuptools, py3-cassandra-medusa, kubeflow-katib, dask-kubernetes, label-studio, kserve, azure-functions-python-worker, duplicity, opal, emissary, py3-setuptools, tritonserver-backend-vllm-cuda-12.9, tensorflow-cpu-jupyter,...
OESA-2026-1105 mod_security_crs security update
The base rules are provided for modsecurity by this package. Security Fixes: The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart...
CVE-2026-22690 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-22691 vulnerabilities
Vulnerabilities for packages: open-webui...
PT-2026-1997
Name of the Vulnerable Software and Affected Versions Open WebUI affected versions not specified Description A flaw exists in Open WebUI that allows network-adjacent attackers to disclose sensitive information. The issue stems from transmitting credentials in plaintext through an unspecified...
(0Day) Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of credentials provided to the endpoint. The issue results fro...
OWASP CRS 安全漏洞
OWASP CRS is an open source attack detection rule set from the CRS Project. A security vulnerability exists in OWASP CRS versions prior to 4.22.0 and prior to 3.3.8, which stems from a flaw in rule 922110 when processing multipart requests, which could lead to malicious character sets being ignor...
CVE-2025-66019 vulnerabilities
Vulnerabilities for packages: open-webui, nemo...
CVE-2025-68480 vulnerabilities
Vulnerabilities for packages: open-webui, airflow, ggshield...
GHSA-428G-F7CQ-PGP5 vulnerabilities
Vulnerabilities for packages: ggshield, open-webui, airflow-core, airflow, py3-marshmallow, superset...
CVE-2025-63391
An authentication bypass vulnerability exists in Open-WebUI =0.6.32 in the /api/config endpoint. The endpoint lacks proper authentication and authorization controls, exposing sensitive system configuration data to unauthenticated remote attackers...
CVE-2025-63391
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2025-63391
...
