109 matches found
CVE-2026-27628 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-24688 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-27025 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-996Q-PR4M-CVGQ vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-27205 vulnerabilities
Vulnerabilities for packages: airflow-core, mitmproxy, kubeflow-volumes-web-app, emissary, mlflow, airflow, open-webui...
CVE-2026-26013 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-23949 vulnerabilities
Vulnerabilities for packages: authentik-fips, py3-setuptools, dask-kubernetes, ansible-operator, tensorflow-cpu-jupyter, ansible-operator-fips, kubeflow-jupyter-web-app, kubeflow-katib, pgadmin4, emissary, tensorflow-gpu-jupyter, mlflow, authentik, apache-beam-python-3.11-sdk, nemo, opal,...
CVE-2026-22690 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-22691 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2025-68480 vulnerabilities
Vulnerabilities for packages: ggshield, airflow, open-webui...
GHSA-428G-F7CQ-PGP5 vulnerabilities
Vulnerabilities for packages: airflow-core, py3-marshmallow, ggshield, airflow, superset, open-webui...
CVE-2025-63391
An authentication bypass vulnerability exists in Open-WebUI =0.6.32 in the /api/config endpoint. The endpoint lacks proper authentication and authorization controls, exposing sensitive system configuration data to unauthenticated remote attackers...
CVE-2025-63391
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2025-63391
...
Exploit for CVE-2023-12345
Exploit-DB MCP Server for Pentesting A Model Context Protocol...
GHSA-9H52-P55H-VW2F vulnerabilities
Vulnerabilities for packages: semgrep, open-webui...
GHSA-9H52-P55H-VW2F vulnerabilities
Vulnerabilities for packages: semgrep, open-webui...
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'
Summary A Stored XSS vulnerability has been discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as...