992135 matches found
open-interpreter (>=0.1.12, <=0.1.17), promptmodel (>=0.0.25, <=0.0.31) potentially affected by CVE-2026-47102 via litellm (0.13.2)
litellm PYPI version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.12, =0.0.25, =0.0.31 Source cves: CVE-2026-47102 Source advisory: OSV:PYSEC-2026-2600...
open-interpreter (>=0.1.8, <=0.1.9), openplugin (>=0.0.25, <=0.0.31) potentially affected by CVE-2026-47101 via litellm (0.7.10)
litellm PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.8, =0.0.25, =0.0.31 Source cves: CVE-2026-47101 Source advisory: OSV:PYSEC-2026-2598...
bavisitter (>=0.0.0, <=0.1.0rc1), cosmoai (>=0.8.8, <=0.9.1.11) +1 more potentially affected by CVE-2026-47101 via litellm (0.13.0)
litellm PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - bavisitter =0.0.0, =0.8.8, =0.9.1.11 - open-interpreter 0.1.11 Source cves: CVE-2026-47101 Source advisory: OSV:PYSEC-2026-2598...
open-interpreter (>=0.1.12, <=0.1.17), promptmodel (>=0.0.25, <=0.0.31) potentially affected by CVE-2026-47101 via litellm (0.13.2)
litellm PYPI version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.12, =0.0.25, =0.0.31 Source cves: CVE-2026-47101 Source advisory: OSV:PYSEC-2026-2598...
mcp-open-client (0.4.27), synth-mapping-helper (>=1.5.16, <=1.5.18) potentially affected by CVE-2026-45554 via nicegui (2.21.1)
nicegui PYPI version 2.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - mcp-open-client 0.4.27 - synth-mapping-helper =1.5.16, =1.5.18 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45672 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45672 Source advisory: OSV:PYSEC-2026-2698...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45675 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45675 Source advisory: OSV:PYSEC-2026-2730...
PYSEC-2026-2698 Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
Summary The /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLECODEEXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Details The...
mcp-open-client (0.4.27), synth-mapping-helper (>=1.5.16, <=1.5.18) potentially affected by CVE-2026-45553 via nicegui (2.21.1)
nicegui PYPI version 2.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - mcp-open-client 0.4.27 - synth-mapping-helper =1.5.16, =1.5.18 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...
PYSEC-2026-2755 Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
Server-Side Request Forgery SSRF Bypass via HTTP Redirect Following in Web-Fetch, Image-Load, and Chat-Completion Endpoints Summary The validateurl function in backend/openwebui/retrieval/web/utils.py only validates the initial URL submitted by the caller. The HTTP clients used downstream sync...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45401 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45401 Source advisory: OSV:PYSEC-2026-2755...
PYSEC-2026-2706 Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure
Vulnerability Type: Information Disclosure / Missing Authentication Severity: Medium Component: backend/openwebui/routers/retrieval.py — getstatus GET / Affected Endpoint: GET /api/v1/retrieval/ Affected Version: Open WebUI main branch — confirmed unpatched through v0.9.2 Authentication Required:...
Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
SummaryAny authenticated user can permanently delete files owned by other users via DELETE /api/v1/files/id when the target file is referenced in any shared chat. The hasaccesstofile authorization gate unconditionally grants access through its shared-chat branch. It checks neither the requesting...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45402 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45402 Source advisory: OSV:PYSEC-2026-2752...
PYSEC-2026-2767 Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint
Summary An IDOR vulnerability exists in the Channels feature of Open WebUI, allowing any channel member to modify messages sent by other members including administrators within the same channel. This vulnerability affects the latest version v0.8.12 of Open WebUI. Details In the updatemessagebyid...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45667 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45667 Source advisory: OSV:PYSEC-2026-2747...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45351 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45351 Source advisory: OSV:PYSEC-2026-2741...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45671 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45671 Source advisory: OSV:PYSEC-2026-2692...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45398 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45398 Source advisory: OSV:PYSEC-2026-2699...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-45397 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-45397 Source advisory: OSV:PYSEC-2026-2706...