13 matches found
GHSA-3WP3-XXJ9-5JQQ Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
Summary The getallmodels handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of keybuilder=. In aiocache 0.12.3 the pinned version, key= is a static cache...
axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-49119 via gradio (5.49.1)
gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-49119 Source advisory: OSV:GHSA-J36P-7W88-G82J...
axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-49119 via gradio (5.49.1)
gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-49119 Source advisory: OSV:PYSEC-2026-2179...
axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-10783 via gradio (5.49.1)
gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-10783 Source advisory: OSV:GHSA-6655-8PH2-63J3...
axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-10783 via gradio (5.49.1)
gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...
axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-48545 via gradio (5.49.1)
gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-48545 Source advisory: OSV:GHSA-7HP7-4P35-3CX2...
CVE-2026-44556
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests directly to upstream LLM providers without enforcing per-model access control. While...
CVE-2026-44556: Improper Access Control
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests directly to upstream LLM providers without enforcing per-model access control. While...
axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-28416 via gradio (5.49.1)
gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-28416 Source advisory: OSV:GHSA-JMH7-G254-2CQ9...
axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-28415 via gradio (5.49.1)
gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-28415 Source advisory: OSV:GHSA-PFJF-5GXR-995X...
axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-28414 via gradio (5.49.1)
gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-28414 Source advisory: OSV:PYSEC-2026-64...
axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-28416 via gradio (5.49.1)
gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-28416 Source advisory: OSV:PYSEC-2026-66...
axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-28415 via gradio (5.49.1)
gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-28415 Source advisory: OSV:PYSEC-2026-65...