CVE-2026-12061 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-59938 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-9XWG-3R6F-JCX2 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-GM37-52C6-37MW vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-59936 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-59937 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-67422 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-FG7F-2386-8897 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-55H5-XMCQ-C37V vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-5XF7-4P34-54QR vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-59935 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-G867-7843-WF8Q vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-5QJQ-93H5-HRGP vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-71554 vulnerabilities

Vulnerabilities for packages: mitmproxy, open-webui, airflow...

GHSA-6HR6-W5QG-QMWG vulnerabilities

Vulnerabilities for packages: open-webui, authentik-fips, localstack, prefect-fips, apache-beam-python-3.14-sdk, mitmproxy, jupyter-all-spark-notebook, airflow, authentik...

CVE-2026-70491

creationtimestamp| type| source ---|---|--- 2026-08-04 22:35:12+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-3r7g-q6cg-q2vx 2026-08-05 14:31:53+00:00| seen| https://gist.github.com/alon710/33c3bff7f99aec7fdcddc66966d519a0...

CVE-2026-70493

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

CVE-2026-70491

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70492

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...

CVE-2026-70487

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file i...