PT-2026-59399

Summary An internal-only bypass filter parameter is exposed on the /openai/chat/completions and /ollama/api/chat HTTP endpoints via FastAPI query string binding, allowing any authenticated user to append ?bypass filter=true and bypass model access control checks to invoke admin-restricted models...

CVE-2026-45365

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, an internal-only bypassfilter parameter is exposed on the /openai/chat/completions and /ollama/api/chat HTTP endpoints via FastAPI query string binding, allowing any authenticated...

CVE-2026-45365

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, an internal-only bypassfilter parameter is exposed on the /openai/chat/completions and /ollama/api/chat HTTP endpoints via FastAPI query string binding, allowing any authenticated...

EUVD-2026-30649

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, an internal-only bypassfilter parameter is exposed on the /openai/chat/completions and /ollama/api/chat HTTP endpoints via FastAPI query string binding, allowing any authenticated...

PT-2026-41183

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.8.11 Description An internal-only bypass filter parameter is exposed on the '/openai/chat/completions' and '/ollama/api/chat' HTTP endpoints due to FastAPI query string binding. This allows any authenticated user...

@saltcorn/cli (>=1.1.1-beta.0, <=1.4.1), @saltcorn/mobile-builder (>=1.1.1-beta.0, <=1.4.1) +1 more potentially affected by unknown CVE via @saltcorn/admin-models (>=1.1.1, <=1.4.1-beta.3)

@saltcorn/admin-models NPM version =1.1.1, =1.1.1-beta.0, =1.1.1-beta.0, =1.1.1-beta.0, =1.4.1 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNADMINMODELS-15126138...

Cross-site Scripting (XSS)

Overview @saltcorn/admin-models is a models only required by the admin interface for Saltcorn, open-source no-code platform Affected versions of this package are vulnerable to Cross-site Scripting XSS and code execution, via the name parameter on the /admin/edit-codepage endpoint and improper...

Cross site scripting

Cross site scripting XSS in the photo-gallery 10Web Photo Gallery plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php...

CVE-2019-16117

Cross site scripting XSS in the photo-gallery 10Web Photo Gallery plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php...

CVE-2019-16117: Improper Neutralization of Input During Web Page Generation

Cross site scripting XSS in the photo-gallery 10Web Photo Gallery plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php...

PT-2019-12063

Name of the Vulnerable Software and Affected Versions Form Maker plugin versions prior to 1.13.3 Description The issue allows for SQL injection in the get labels parameters function, located in the form-maker/admin/models/Submissions fm.php file, by providing a crafted value for the...