5207 matches found
PT-2026-78639
Heap-based buffer overflow in the multipart form-data parser in jst post.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request...
RDK-B WebUI contains multiple vulnerabilities
Overview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication,...
CVE-2026-59714
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
EUVD-2026-58246
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714
CVE-2026-59714 describes a cross-channel message overwrite vulnerability in Open WebUI exposed by the chat-completions path. From v0.9.5 to before v0.10.0, an authenticated user could overwrite a message in a channel they do not belong to by using a channel: chat_id with a caller-supplied message...
CVE-2026-59714: Missing Authorization
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
GHSA-FP3F-MC75-235C vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-FWG2-594C-JP42 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-71870 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-71852 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-6HM5-JGCP-P838 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-QVV7-CG9C-W4X3 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-XH95-F55M-82FW vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-12072 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-12075 vulnerabilities
Vulnerabilities for packages: open-webui...
