988991 matches found
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
SummaryOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the...
PYSEC-2026-4115 Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
Summary External knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for othe...
PYSEC-2026-4125 Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
Summary The built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...
PYSEC-2026-4128 Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...
PYSEC-2026-4120 Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...
CVE-2021-22873-EXPLOIT
CVE-2021-22873 - Revive Adserver Open Redirect Vulnerability Revive Adserver before version 5.1.0 is vulnerable to open redirects via the dest, oadest, and/or ct0 parameters of the lg.php and ck.php delivery scripts. Originally, this functionality was designed to allow third-party ad servers to...
Grafana-cve-2025-4123
Grafana-cve-2025-4123 Result FOFA app="Grafana" Shodan product:"Grafana Open Source" SSRF http://localhost:3000/render/public/..%252f%255COpenRedirectURL%252f%253F%252f..%252f.. Open Redirect /public/..%2F%5cwebsite.com%2F%3f%2F..%2F...
CVE-2026-83589
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...
CVE-2026-83589 Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...
EUVD-2026-90589
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...
CVE-2026-83589
A flaw in oauth-proxy allows for an open redirect due to insufficient validation of the destination redirect parameter (rd) during post-login redirection. Specifically, the application may be susceptible to bypasses using // and / sequences. A remote attacker can exploit this by tricking a user i...
CVE-2026-83589 Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...
CLEANSTART-2024-OJ63880 Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL
Security vulnerability affects the drupal7 package. Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL...
GHSA-XPV3-W29H-X7CV vulnerabilities
Vulnerabilities for packages: kubeflow-katib, dask-kubernetes, open-webui, k8s-sidecar, jupyter-base-notebook, kubeflow-volumes-web-app, kubeflow-jupyter-web-app, kubeflow-pipelines, kserve, az, ggshield, datadog-agent, kubeflow-pipelines-visualization-server...
CVE-2026-49265 vulnerabilities
Vulnerabilities for packages: kubeflow-katib, dask-kubernetes, open-webui, k8s-sidecar, jupyter-base-notebook, kubeflow-volumes-web-app, kubeflow-jupyter-web-app, kubeflow-pipelines, kserve, az, ggshield, datadog-agent, kubeflow-pipelines-visualization-server...
GHSA-R6X4-923Q-G947 vulnerabilities
Vulnerabilities for packages: open-webui, py3-cassandra-medusa, kserve, semgrep, superset, ggshield, datadog-agent...
CVE-2026-102269 vulnerabilities
Vulnerabilities for packages: open-webui, py3-cassandra-medusa, kserve, semgrep, superset, ggshield, datadog-agent...
CVE-2026-102272 vulnerabilities
Vulnerabilities for packages: open-webui, py3-cassandra-medusa, kserve, semgrep, superset, ggshield, datadog-agent...