CVE-2026-21860 vulnerabilities

Vulnerabilities for packages: superset...

GHSA-4F6G-68PF-7VHV vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-4XC4-762W-M6CG vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-87HC-H4R5-73F7 vulnerabilities

Vulnerabilities for packages: superset...

GHSA-4F6G-68PF-7VHV vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-4XC4-762W-M6CG vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-87HC-H4R5-73F7 vulnerabilities

Vulnerabilities for packages: superset, tensorflow-cpu-jupyter, azure-functions-python-worker...

PT-2026-1995

Name of the Vulnerable Software and Affected Versions Open WebUI affected versions not specified Description A flaw exists in Open WebUI that allows remote attackers to execute arbitrary code. Authentication is required to exploit this issue. The vulnerability is located within the install...

(0Day) Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists within the loadtoolmodulebyid function. The issue results from the lack of proper validation of a...

(0Day) Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists within the installfrontmatterrequirements function.The issue results from the lack of proper validation ...

CVE-2025-3730 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-887C-MR87-CXWP vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2025-66019 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-887C-MR87-CXWP vulnerabilities

Vulnerabilities for packages: py3-torch-cuda-12.8...

CVE-2025-3730 vulnerabilities

Vulnerabilities for packages: py3-torch-cuda-12.8...

Open WebUI DOM-Based XSS

The vulnerability of the .innerHTML component in Open WebUI-based web interfaces exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute a DOM-Based XSS attack remotely...

GHSA-428G-F7CQ-PGP5 vulnerabilities

Vulnerabilities for packages: airflow, open-webui, ggshield...

CVE-2025-68480 vulnerabilities

Vulnerabilities for packages: airflow, open-webui, superset, ggshield, py3-marshmallow, airflow-core...

EUVD-2025-204307

An authentication bypass vulnerability exists in Open-WebUI =0.6.32 in the /api/config endpoint. The endpoint lacks proper authentication and authorization controls, exposing sensitive system configuration data to unauthenticated remote attackers...

CVE-2025-63391

An authentication bypass vulnerability exists in Open-WebUI =0.6.32 in the /api/config endpoint. The endpoint lacks proper authentication and authorization controls, exposing sensitive system configuration data to unauthenticated remote attackers...