5149 matches found
CVE-2026-0766
This CVE entry is rejected/not used as the vendor investigation determined the behavior is intended functionality of the Plugins extension system.
CVE-2026-0766 Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability
Open WebUI loadtoolmodulebyid Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists within the...
CVE-2026-0766
Open WebUI loadtoolmodulebyid Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists within the...
CVE-2026-0766 Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability
Open WebUI loadtoolmodulebyid Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists within the...
CVE-2026-0765 Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability
Open WebUI PIP installfrontmatterrequirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists...
CVE-2026-0765
Open WebUI PIP installfrontmatterrequirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists...
CVE-2026-0765 Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability
Open WebUI PIP installfrontmatterrequirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists...
Open WebUI: Operating System Command Injection Vulnerability
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Open WebUI has a vulnerability related to operating system command injection. This vulnerability stems from the lack of validation for the strings provided by users in the...
Open WebUI security vulnerabilities
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Open WebUI has a security vulnerability that stems from transmitting sensitive information in plaintext when handling credentials, which may lead to information leakage...
Open WebUI Code Injection Vulnerability
Open WebUI is an open-source, scalable, feature-rich, and user-friendly self-hosted WebUI. Open WebUI has a code injection vulnerability, which stems from the lack of validation for the string provided by users in the loadtoolmodulebyid function. This vulnerability may lead to code injection and...
CVE-2026-23949 vulnerabilities
Vulnerabilities for packages: semgrep, kserve, mlflow, open-webui, py3-cassandra-medusa, dask-kubernetes, pypy-3.10, pypy-3.11, airflow, superset, kubeflow-katib, datadog-agent, py3-setuptools, emissary, kubeflow-jupyter-web-app...
CVE-2026-0622
Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...
GHSA-58PV-8J8X-9VJ2 vulnerabilities
Vulnerabilities for packages: semgrep, kserve, mlflow, open-webui, py3-cassandra-medusa, dask-kubernetes, pypy-3.10, pypy-3.11, airflow, superset, kubeflow-katib, datadog-agent, py3-setuptools, emissary, kubeflow-jupyter-web-app...
GHSA-58PV-8J8X-9VJ2 vulnerabilities
Vulnerabilities for packages: py3-setuptools, superset, ansible-operator, nemo, tensorflow-cpu-jupyter, kserve, authentik, kubeflow-jupyter-web-app, dask-kubernetes, airflow, semgrep, authentik-fips, tensorflow-gpu-jupyter, wazuh-manager-fips, awx, azure-functions-python-worker, mlflow,...
CVE-2026-0622
Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...
CVE-2026-0622
The Open 5GS WebUI component (an open-source 5G core network implementation) contains a vulnerability where it uses a hard-coded JWT signing key (change-me) whenever the JWT_SECRET_KEY environment variable is not explicitly set. An unauthenticated network attacker can exploit this to forge valid ...