CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

2312 matches found

Nuclei•added 2026/10/06 2:09 a.m.•44 views

Open WebUI < 0.9.5 - Information Disclosure

Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. id: CVE-2026-45397 info: name: Open...

5.3CVSS6.1AI score0.00808EPSS

SaveExploits1References3

Nuclei•added 2026/10/06 2:09 a.m.•54 views

Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

9.1CVSS8AI score0.01634EPSS

SaveExploits1References2

Kitploit•added 2026/10/05 5:21 p.m.•17 views

enforcement-coverage

Cobertura de Cumplimiento Encuentra rutas de API que llevan un control de autorización más débil que el de sus rutas hermanas. Encontró CVE-2026-45316 en Open WebUI solo a partir del código fuente, sin conocimiento de avisos de seguridad: MISMATCH POST /notes/id/pin notes.py:pinnotebyid 3/3...

3.5CVSS6AI score0.00257EPSS

SaveExploits1

Kitploit•added 2026/10/05 11:17 a.m.•11 views

ai-kubernetes-helm-chart-security

AI on Kubernetes: Helm chart security defaults evidence This repository holds the data and evidence behind the Sorami technical report "AI on Kubernetes: 10 of 14 Helm charts ship with no API auth" version 1.2. Read the report here: https://sorami.com.au/research/ai-kubernetes-helm-chart-security...

6.2AI score

SaveExploits0References7

Kitploit•added 2026/10/05 9:05 a.m.•12 views

CVE-2024-7808

CVE-2024-7808 💀 $$\colorred ESTE \space EXPLOIT \space PUEDE \space VIOLAR \space LA \space LEY.$$ $$\colorred\space USTED \space ES \space RESPONSABLE \space DE \space SUS \space ACCIONES.$$ $$\colorredSOLO \space CON \space FINES \space DE \space DEMOSTRACIÓN.$$ DESCRIPCIÓN RCE por usuarios no...

9.8CVSS7.8AI score0.01235EPSS

SaveExploits2

Kitploit•added 2026/10/05 7:14 a.m.•18 views

CVE-2025-64495-POC

CVE-2025-64495-POC Open WebUI es vulnerable a DOM XSS almacenado a través de prompts cuando 'Insertar Prompt como Texto Enriquecido' está habilitado, resultando en ATO/RCE Resumen La funcionalidad que inserta prompts personalizados en la ventana de chat es vulnerable a DOM XSS cuando 'Insertar...

8.7CVSS8.1AI score0.0046EPSS

SaveExploits2