363 matches found
EUVD-2025-208453
A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/startwindows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUISECRETKEY leads to insufficiently random values. It is possible to launch the attack...
CVE-2025-15603
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh...
PT-2026-24109
A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/start windows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUI SECRET KEY leads to insufficiently random values. It is possible to launch the...
GHSA-2RW7-X74F-JG35 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-2G6R-C272-W58R vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-2RW7-X74F-JG35 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-28351 vulnerabilities
Vulnerabilities for packages: open-webui, litellm, nemo...
CVE-2026-27628 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-24688 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-996Q-PR4M-CVGQ vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-27025 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-27205 vulnerabilities
Vulnerabilities for packages: kubeflow-volumes-web-app, open-webui, emissary, airflow-core, mitmproxy, mlflow, airflow...
CVE-2026-26013 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-23949 vulnerabilities
Vulnerabilities for packages: apache-beam-python-3.11-sdk, spamcheck, datadog-agent, localstack, py3-cassandra-medusa, label-studio, py3-setuptools, ansible-operator-fips, airflow, open-webui, emissary, kubeflow-jupyter-web-app, py3.9-setuptools, opal, mlflow, ansible-operator, datadog-agent-fips...
OESA-2026-1105 mod_security_crs security update
The base rules are provided for modsecurity by this package. Security Fixes: The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart...
CVE-2026-22691 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-22690 vulnerabilities
Vulnerabilities for packages: open-webui...
PT-2026-1997
Name of the Vulnerable Software and Affected Versions Open WebUI affected versions not specified Description A flaw exists in Open WebUI that allows network-adjacent attackers to disclose sensitive information. The issue stems from transmitting credentials in plaintext through an unspecified...
(0Day) Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Open WebUI. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of credentials provided to the endpoint. The issue results fro...