363 matches found
GHSA-C7WP-3QH5-55PV Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels
Missing Access Check on Channel Members Endpoint for Standard Channels Affected Component Channel members listing endpoint: - backend/openwebui/routers/channels.py lines 445-507, getchannelmembersbyid Affected Versions Current main branch and likely all versions with the channels feature...
GHSA-7RJH-PX4V-5W55 Open WebUI's Channel Access Grants Bypass filter_allowed_access_grants
Channel Access Grants Bypass filterallowedaccessgrants Affected Component Channel creation and update endpoints: - backend/openwebui/routers/channels.py lines 291-340, createnewchannel - backend/openwebui/routers/channels.py lines 617-638, updatechannelbyid - backend/openwebui/models/channels.py...
Missing Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the basemodelid process. An attacker can gain unauthorized access to restricted models by creating a new model that chains to a restricted base model and invoking it, causing the serv...
NPM: open-webui Vulnerable to Stored XSS via Model Description
NPM: open-webui Vulnerable to Stored XSS via Model Description vulnerability discovered by ? in WordPress Npm open-webui versions = 0.8.12...
Cross-site Scripting (XSS)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS in the sanitizeResponseContent process. An attacker can execute arbitrary JavaScript in the browser of another user by crafting a malicious model description containing a markdown lin...
Thousands of Vibe-Coded Apps Expose Corporate and Personal Data on the Open Web
Companies like Lovable, Base44, Replit, and Netlify use AI to let anyone build a web app in seconds—and in thousands of cases, spill highly sensitive data onto the public internet...
CVE-2026-41168 vulnerabilities
Vulnerabilities for packages: open-webui, nemo, litellm...
CVE-2026-41313 vulnerabilities
Vulnerabilities for packages: open-webui, nemo, litellm...
CVE-2026-41182 vulnerabilities
Vulnerabilities for packages: langfuse-fips, langfuse, kibana, librechat, open-webui...
CVE-2026-42215 vulnerabilities
Vulnerabilities for packages: checkov, awx, mlflow, open-webui, mlflow-fips, datahub-ingestion-fips, opal...
CVE-2026-41314 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-44569
creationtimestamp| type| source ---|---|--- 2026-05-05 20:20:01+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jxwr-g6r6-j3fx...
CVE-2026-44567
creationtimestamp| type| source ---|---|--- 2026-05-05 15:47:41+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-4vg5-rp28-gvjf...
CVE-2026-44566
creationtimestamp| type| source ---|---|--- 2026-05-05 15:44:20+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-9pgh-j74g-qj6m...
GHSA-FV5P-P927-QMXR vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-JJ6C-8H6C-HPPX vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-FV5P-P927-QMXR vulnerabilities
Vulnerabilities for packages: open-webui, py3-langchain-text-splitters...
ai-security-poc
AI Security POC A fully containerised proof-of-concept for te...
JLSEC-2026-137
Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Academy Software Foundation OpenEXR. User interaction is required to exploit this...