openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45671 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45671 Source advisory: SNYK:PYTHON-OPENWEBUI-16725765...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45671 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45671 Source advisory: OSV:GHSA-26G9-27VM-X3Q8...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45671 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45671 Source advisory: GHSA-26G9-27VM-X3Q8...

Authorization Bypass Through User-Controlled Key

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the hasaccesstofile process. An attacker can permanently delete files owned by other users, as well as read or modify their contents, by leveraging access t...

Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

Summary GET /api/v1/memories/ef is accessible without authentication and executes request.app.state.EMBEDDINGFUNCTION.... This allows any unauthenticated caller to trigger embedding generation which can lead to direct cost exposure if a paid provider is used. Code reference:...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45667 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45667 Source advisory: GHSA-M69W-P7M4-585J...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45667 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45667 Source advisory: SNYK:PYTHON-OPENWEBUI-16725769...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45667 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45667 Source advisory: OSV:GHSA-M69W-P7M4-585J...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45666 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45666 Source advisory: SNYK:PYTHON-OPENWEBUI-16725482...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45666 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45666 Source advisory: GHSA-X3QM-P8HR-3C3H...

Authorization Bypass Through User-Controlled Key

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the GET /api/v1/notes/noteid endpoint due to missing authorization checks. An attacker can access and retrieve notes belonging to other users by manipulatin...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45666 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45666 Source advisory: OSV:GHSA-X3QM-P8HR-3C3H...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45665 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45665 Source advisory: SNYK:PYTHON-OPENWEBUI-16725483...

NPM: Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order

NPM: Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order vulnerability discovered by ? in WordPress Npm open-webui versions = 0.7.2...

Cross-site Scripting (XSS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper sanitization order in the Banner component. An attacker can execute arbitrary JavaScript in the context of privileged users by injecting malicious payloads into the banne...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45402 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45402 Source advisory: OSV:GHSA-R472-MW7M-967F...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45402 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45402 Source advisory: GHSA-R472-MW7M-967F...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45402 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45402 Source advisory: SNYK:PYTHON-OPENWEBUI-16755448...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2025-64495 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2025-64495 Source advisory: GHSA-3WGJ-C2HG-VM6Q...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-56398 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-56398 Source advisory: SNYK:PYTHON-OPENWEBUI-16725481...