CVE-2025-15603

Open WebUI up to version 0.6.16 is reported to contain a security issue in the JWT Key Handler, specifically in the file backend/start_windows.bat. Manipulating the WEBUI_SECRET_KEY argument can lead to insufficient randomness in keys, potentially enabling remote exploitation. Multiple connected ...

CVE-2025-15603

...

Open WebUI 安全特征问题漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI with open-source code. Versions of Open WebUI prior to 0.6.16 have a security vulnerability related to the parameter WEBUISECRETKEY, where insufficient randomness was present in the handling of this parameter...

GHSA-2G6R-C272-W58R vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-28351 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-F2V5-7JQ9-H8CG vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-F2V5-7JQ9-H8CG vulnerabilities

Vulnerabilities for packages: nemo, open-webui, litellm...

CVE-2026-27628 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-WGVP-VG3V-2XQ3 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-2Q4J-M29V-HQ73 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-996Q-PR4M-CVGQ vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-27025 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-9MVC-8737-8J8H vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-27024 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-27026 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-29VQ-49WR-VM6X vulnerabilities

Vulnerabilities for packages: kubeflow-volumes-web-app, kubeflow-pipelines-visualization-server, mlflow, airflow, superset, emissary, open-webui...

CVE-2026-27199 vulnerabilities

Vulnerabilities for packages: kubeflow-volumes-web-app, kubeflow-pipelines-visualization-server, mlflow, airflow, superset, emissary, open-webui...

GHSA-68RP-WP8R-4726 vulnerabilities

Vulnerabilities for packages: kubeflow-volumes-web-app, mlflow, airflow, emissary, open-webui, mitmproxy...

CVE-2026-27205 vulnerabilities

Vulnerabilities for packages: kubeflow-volumes-web-app, mlflow, airflow, emissary, open-webui, mitmproxy...

CVE-2026-26193

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the embeds property on a response message, the content of which is loaded into an iFrame with a sandbox that has allow-scripts...