3445 matches found
PT-2026-110703
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.7.0 through 0.11.3 Description A cross-origin message handling issue exists in the SyncStatsModal component. This allows an external website to steal a signed-in user's session token by sending unvalidated verify:chat...
PT-2026-110702
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has access to file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file...
CVE-2026-109290: Improper Neutralization of Input During Web Page Generation
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...
CVE-2026-109294: Uncontrolled Resource Consumption
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, whi...
GHSA-379C-QX7V-6H59 vulnerabilities
Vulnerabilities for packages: nemo-rl-cuda-13.0, nemo-gym, open-webui...
CVE-2026-66007 vulnerabilities
Vulnerabilities for packages: nemo-rl-cuda-13.0, nemo-gym, open-webui...
CVE-2026-66007 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-379C-QX7V-6H59 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-27VJ-QCQG-25RC vulnerabilities
Vulnerabilities for packages: kserve, open-webui...
CVE-2026-104851 vulnerabilities
Vulnerabilities for packages: kserve, open-webui...
CVE-2026-102994 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-102995 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-102998 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-103000 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-FP3H-C4FM-7VVF vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-PHP9-FJ8V-98FJ vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-102993 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-102996 vulnerabilities
Vulnerabilities for packages: open-webui...