5196 matches found
PT-2025-49128
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.37 Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. A Server-Side Request Forgery SSRF vulnerability in Open WebUI allows any authenticated user to...
CVE-2025-63681
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
CVE-2025-65958: Server-Side Request Forgery (SSRF)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery SSRF vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to...
CVE-2025-63681: Improper Access Control
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
CVE-2025-63681
Open-WebUI CVE-2025-63681 affects v0.6.33. The API endpoint /api/tasks/stop/ allows direct cancellation of tasks without verifying ownership, enabling a normal user to stop arbitrary LLM response tasks (Incorrect Access Control). Base score 4.3 (Medium); attack vector NETWORK, privileges required...
PT-2025-49146
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.37 Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. A Stored Cross-Site Scripting XSS issue was identified in the Notes PDF download functionality. ...
CVE-2025-65959: Improper Neutralization of Input During Web Page Generation
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing...
Open WebUI 跨站脚本漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site scripting vulnerability exists in versions of Open WebUI prior to 0.6.37 that stems from a stored cross-site scripting attack that could lead to arbitrary JavaScript execution and...
Open WebUI 代码问题漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A code issue vulnerability exists in versions of Open WebUI prior to 0.6.37 that stems from server-side request forgery and could lead to access to internal networks and services...
CVE-2025-63681
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
Open WebUI 安全漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version v0.6.33, which stems from the API /api/tasks/stop/ direct access and cancel tasks without verifying user ownership, which could lead an...
CVE-2025-63681
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
EUVD-2025-200015
Malicious code in @bingads-webui-clientcenter/instrumentation npm...
Malicious code in @bingads-webui-clientcenter/instrumentation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7efd2376e1aa13253ea637d39c491337b642dec3198639e7b492c1aec1c083ad The package @bingads-webui-clientcenter/instrumentation was found to contain malicious code...
MAL-2025-191495 Malicious code in @bingads-webui-clientcenter/instrumentation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7efd2376e1aa13253ea637d39c491337b642dec3198639e7b492c1aec1c083ad The package @bingads-webui-clientcenter/instrumentation was found to contain malicious code...
GHSA-M449-CWJH-6PW7 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-M449-CWJH-6PW7 vulnerabilities
Vulnerabilities for packages: nemo, open-webui...
CVE-2025-65106 vulnerabilities
Vulnerabilities for packages: open-webui...