CGA-QHRH-752C-5G54

Bulletin has no description...

CGA-RC4Q-8XW3-C9MC

Bulletin has no description...

CGA-H74X-H633-W4WJ

Bulletin has no description...

CGA-Q4QV-2FPV-F98G

Bulletin has no description...

CGA-263Q-GXG6-7396

Bulletin has no description...

CGA-QG39-76C7-84HC

Bulletin has no description...

CGA-C79V-MQHW-7357

Bulletin has no description...

CGA-54C8-G8XV-MFR3

Bulletin has no description...

CGA-47JV-Q64J-J4QQ

Bulletin has no description...

CGA-R44F-JJHV-76VR

Bulletin has no description...

CGA-F9VV-3CFW-JFCV

Bulletin has no description...

CGA-3PX2-9HXV-3F5H

Bulletin has no description...

GHSA-387M-935M-C4VW

creationtimestamp| type| source ---|---|--- 2026-07-09 17:11:45+00:00| seen| https://gist.github.com/alon710/4972c27e69247db8e70c7471b199efc4...

CVE-2026-59224

Open WebUI vulnerability CVE-2026-59224 affects versions prior to 0.10.0. The issue: in backend/open_webui/routers/terminals.py, the ws_terminal upstream URL is built from an unencoded session_id and appends user_id as a query parameter, enabling query injection to make the terminal backend resol...

CVE-2026-59224 Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/openwebui/routers/terminals.py built the wsterminal upstream URL from an unencoded sessionid and appended userid as a query parameter, allowing query injection to make the terminal backe...

CGA-CRXV-M6QW-55R4

Bulletin has no description...

CVE-2026-59215 Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread parent and reply handling did not bind parentid to the channel in the URL, allowing an authenticated user to reference a message from another private or DM channel and disclose...

CVE-2026-59217 Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload path accepted metadata.knowledgeid and auto-linked uploaded files to a target knowledge base without applying the write-access check used by /api/v1/knowledge//file/add, allowing...

CVE-2026-54798

creationtimestamp| type| source ---|---|--- 2026-07-09 16:47:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqa3kptfir27 2026-07-10 14:00:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccogp5db24 2026-07-16 16:15:03+00:00| seen|...

CVE-2026-11404

creationtimestamp| type| source ---|---|--- 2026-07-09 16:19:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7zyixrry2e 2026-07-11 00:29:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdftvzixw2e...