CVE-2026-45399

creationtimestamp| type| source ---|---|--- 2026-05-10 19:37:29+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-8jjp-r2w2-4v22...

CVE-2026-45387

creationtimestamp| type| source ---|---|--- 2026-05-10 19:31:55+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-h2cw-7qw9-56xr...

CVE-2026-45365

creationtimestamp| type| source ---|---|--- 2026-05-10 11:15:24+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-v6qf-75pr-p96m...

CVE-2026-45350

creationtimestamp| type| source ---|---|--- 2026-05-09 23:30:56+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-4pcg-253r-rf9w...

CVE-2026-42571 Privilege Escalation Attack affecting Pelican Web UI

Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to before 7.23.3, and 7.24.0 to before 7.24.2, there is a a privilege escalation vulnerability affecting Pelican's Web User Interface WebUI. This attack allows any user...

CVE-2026-42571

Pelican Web UI privilege escalation affects multiple series (7.21.x before 7.21.5, 7.22.x before 7.22.3, 7.23.x before 7.23.3, 7.24.x before 7.24.2). An authenticated WebUI user via OAuth can gain admin privileges under certain configurations. Patches are available in 7.21.5, 7.22.3, 7.23.3, and ...

CVE-2026-45317

creationtimestamp| type| source ---|---|--- 2026-05-09 08:03:05+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-j6w6-986j-2m2m...

CVE-2026-45318

creationtimestamp| type| source ---|---|--- 2026-05-09 08:02:58+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-hcwp-82g6-8wxc...

CVE-2026-45316

creationtimestamp| type| source ---|---|--- 2026-05-09 08:02:53+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jx2x-j75f-xq3j 2026-08-24 21:00:04+00:00| seen| Telegram/SUyvNys0dzEwjXvrLl9vzt4eSnd4PMMSmFi1zAltVWOpQ 2026-08-25 00:00:09+00:00|...

CVE-2026-7946

An insufficient policy enforcement flaw was found in the WebUI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=496016840...

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Deactivated Channel Members Retain Full Access to Group/DM Channels Affected Component Channel membership authorization check: - backend/openwebui/models/channels.py lines 663-673, isuserchannelmember - Used at 15 locations in backend/openwebui/routers/channels.py Affected Versions Current main...

GHSA-MQQ6-CQCX-38VG Open WebUI's Model Import Overwrites Any Model Without Ownership Check

Model Import Overwrites Any Model Without Ownership Check Affected Component Model import endpoint: - backend/openwebui/routers/models.py lines 254-308, importmodels Affected Versions Current main branch commit 6fdd19bf1 and likely all versions with model import functionality. Description The POS...

GHSA-C7WP-3QH5-55PV Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels

Missing Access Check on Channel Members Endpoint for Standard Channels Affected Component Channel members listing endpoint: - backend/openwebui/routers/channels.py lines 445-507, getchannelmembersbyid Affected Versions Current main branch and likely all versions with the channels feature...

NPM: open-webui Vulnerable to Stored XSS via Model Description

NPM: open-webui Vulnerable to Stored XSS via Model Description vulnerability discovered by ? in WordPress Npm open-webui versions = 0.8.12...

CVE-2026-41313 vulnerabilities

Vulnerabilities for packages: open-webui, nemo, litellm...

CVE-2026-41182 vulnerabilities

Vulnerabilities for packages: langfuse, open-webui, kibana, librechat, langfuse-fips...

CVE-2026-42215 vulnerabilities

Vulnerabilities for packages: opal, awx, open-webui, datahub-ingestion-fips, mlflow, mlflow-fips, checkov...

CVE-2026-41314 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-20035: Server-Side Request Forgery (SSRF)

A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by...

PT-2026-41492

Summary The kanidmd web UI renders the WebAuthn passkey-registration challenge as raw JSON inside an inline element using the Askama |safe filter. The challenge embeds the account's displayname, which serde json serialises without escaping . A displayname containing therefore terminates the scrip...