CVE-2026-78680 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-81722 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-81724 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-4XW3-JF9X-X7MF vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-6HWM-XVPH-95VM vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-8X48-8G7J-RQXP vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-CV22-G7MW-8V73 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-CW6X-M8JW-QMRH vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-F794-5JV7-7672 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-FF5C-CP5C-9WJF vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-HQV3-XM29-P9HQ vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-M4RF-3FR8-XWX3 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-5GH2-94QG-QPPQ vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-PF76-Q698-37V8 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-QX2G-XRX7-VFH8 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-VP2X-QP44-57V7 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-WW6M-CW3F-Q94G vulnerabilities

Vulnerabilities for packages: open-webui...

PT-2026-89160

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An authenticated user can create a parent cycle by placing a folder under itself or one of its descendants. This occurs because the system does not validate that the new parent is not the...

PT-2026-89159

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An issue exists in the calendar event model within backend/open webui/models/calendar.py where the meta.alert minutes value is stored without type validation. Because the shared upcoming-eve...

PT-2026-89161

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An issue exists where role synchronization fails to invalidate cached user records during a privilege demotion. When an administrator is demoted via a trusted role header or OAuth role...