1780 matches found
GHSA-GF5M-WCRH-7928 open-webui Vulnerable to Stored XSS via Model Description
!IMPORTANT Relationship to CVE-2024-7990 CVE-2024-7990 issued by huntr.dev, March 2025 describes a stored XSS in the same field — the model description — but exploits a different bypass mechanism: a second-order injection through the sanitizeResponseContent function's video-tag placeholder...
PT-2026-39275
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description The channel router fails to call the filter allowed access grants function during the creation or update of channels. This function is intended to strip unauthorized wildcard grants such as...
PT-2026-39272
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description Open WebUI supports model composition through the base model id variable, allowing a user-defined model to reference a base model for inference. An access control flaw exists where the system...
CVE-2026-41314 vulnerabilities
Vulnerabilities for packages: litellm, nemo, open-webui...
CVE-2026-41312 vulnerabilities
Vulnerabilities for packages: litellm, nemo, open-webui...
CVE-2026-42284 vulnerabilities
Vulnerabilities for packages: checkov, datahub-ingestion-fips, open-webui, mlflow, opal, mlflow-fips, awx...
CVE-2026-41205 vulnerabilities
Vulnerabilities for packages: pgadmin4-fips, superset, jupyter-base-notebook, nemo, dagster, dagster-fips, open-webui, airflow, prefect-fips, mlflow, airflow-core...
CVE-2026-41425 vulnerabilities
Vulnerabilities for packages: pgadmin4-fips, open-webui, airflow, datahub-ingestion-fips, mlflow, datahub-ingestion...
CVE-2026-41481 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-41313 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-41168 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-41312 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-41182 vulnerabilities
Vulnerabilities for packages: langfuse, open-webui...
CVE-2026-42215 vulnerabilities
Vulnerabilities for packages: mlflow, checkov, open-webui...
CVE-2026-42284 vulnerabilities
Vulnerabilities for packages: mlflow, checkov, open-webui...
CVE-2026-41205 vulnerabilities
Vulnerabilities for packages: mlflow, airflow, superset, open-webui, jupyter-base-notebook...
CVE-2026-41425 vulnerabilities
Vulnerabilities for packages: mlflow, airflow, open-webui...
CVE-2026-44565
creationtimestamp| type| source ---|---|--- 2026-05-05 13:19:17+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-j3fw-wc48-29g3 2026-05-15 01:35:17+00:00| seen|...