CVE-2026-70588

CVE-2026-70588 affects the Ghost CMS (Node.js). From 5.26.0 through 6.54.1, the Universal Import feature in Ghost Admin did not properly sanitize imported content, causing an XSS in post content. The issue has been fixed in version 6.54.1. Affected versions should upgrade to 6.54.1 or later to re...

CVE-2026-18813 H3C NX15 esps delete command injection

A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendo...

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of...

CVE-2026-70494 Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/id handler in backend/openwebui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages...

CVE-2026-70494

Open WebUI vulnerability CVE-2026-70494 affects versions 0.10.0–0.11.0 where the DELETE /api/v1/folders/{id} handler allowed a collaborator with write access to a shared folder to permanently delete chats/messages of the folder owner. The issue arises because the subfolder check accepted any inhe...

CVE-2026-70494 Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/id handler in backend/openwebui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages...

CVE-2026-70493

Open WebUI vulnerability CVE-2026-70493 affects the knowledge search path in backend/open_webui/tools/knowledge_fs.py and backend/open_webui/tools/builtin.py for builds from 0.9.6 to 0.11.0. A chat participant can supply a pattern containing regex metacharacters; these patterns were compiled with...

CVE-2026-13227

CVE-2026-13227 affects ERPNext prior to version 15.115.0 and prior to 16.25.0, due to improper authorization in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. The root cause is insufficient access control on this API, enabling inappropriate disclosure or manip...

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

GHSA-3R7G-Q6CG-Q2VX Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

CVE-2026-70491 Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

CVE-2026-70491

Open WebUI vulnerability CVE-2026-70491 affects the self-hosted Open WebUI platform. In versions up to 0.10.2, the GET endpoints /api/v1/tools/, /api/v1/tools/list, and /api/v1/tools/id/{id} exposed full Python tool source to authenticated non-admin read-only users due to the interaction between ...

CVE-2026-70490

Open WebUI (self-hosted AI platform) versions 0.8.8–0.11.0 contain a flaw where the terminal WebSocket route in backend/open_webui/routers/terminals.py authenticates its own first-message JWT and omits the verified-user role gate enforced on HTTP terminal routes. As a result, accounts with pendin...

CVE-2026-70490

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...

CVE-2026-70490 Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Summary In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single FREQ=MINUTELY rule therefore enumerates roughly a quarter-century of occurrences,...

CVE-2026-70489 Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/openwebui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to...

CVE-2026-70489

Technical details about CVE-2026-70489 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-54020 Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticat...

CVE-2026-70488

CVE-2026-70488 – Open WebUI : In Open WebUI builds from 0.9.6 to 0.11.0, the sync cleanup endpoint (POST /api/v1/knowledge/{id}/sync/cleanup) did not properly constrain actions to the target knowledge base. The handler authenticated write access via the URL knowledge base, then acted on directory...