GHSA-9H52-P55H-VW2F vulnerabilities

Vulnerabilities for packages: semgrep, open-webui...

GHSA-9H52-P55H-VW2F vulnerabilities

Vulnerabilities for packages: semgrep, open-webui...

Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'

Summary A Stored XSS vulnerability has been discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as...

open-webui is Vulnerable to Incorrect Access Control

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...

EUVD-2025-38253

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers vi...

GHSA-2QFP-Q593-8484 vulnerabilities

Vulnerabilities for packages: mitmproxy...

GHSA-2QFP-Q593-8484 vulnerabilities

Vulnerabilities for packages: mitmproxy, pgadmin4, superset, nemo...

GHSA-7F5H-V6XP-FCQ8 vulnerabilities

Vulnerabilities for packages: airflow, reflex, open-webui, mlflow, kserve, k8s-sidecar...

CVE-2025-62727 vulnerabilities

Vulnerabilities for packages: airflow, reflex, open-webui, mlflow, kserve, k8s-sidecar...

CVE-2025-62727 vulnerabilities

Vulnerabilities for packages: airflow-core, nemo, mlflow, reflex, airflow, k8s-sidecar, open-webui, kserve...

Hundreds of People With ‘Top Secret’ Clearance Exposed by House Democrats’ Website

A database containing information on people who applied for jobs with Democrats in the US House of Representatives was left accessible on the open web...

EUVD-2014-1533

Malware in sbrugna...

EUVD-2014-1287

Malware in sbrugna...

EUVD-2014-2332

Malware in sbrugna...

EUVD-2010-2681

Malware in sbrugna...

EUVD-2010-2680

Malware in sbrugna...

EUVD-2014-1532

Malware in sbrugna...

EUVD-2025-6966

Malicious code in bioql PyPI...

EUVD-2025-29208

Malicious code in bioql PyPI...

WordPress Epic Bootstrap Buttons plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icol Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via icol Parameter vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Epic Bootstrap Buttons versions = 1.0...