CVE-2026-45318

creationtimestamp| type| source ---|---|--- 2026-05-09 08:02:58+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-hcwp-82g6-8wxc...

CVE-2026-45316

creationtimestamp| type| source ---|---|--- 2026-05-09 08:02:53+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jx2x-j75f-xq3j 2026-08-24 21:00:04+00:00| seen| Telegram/SUyvNys0dzEwjXvrLl9vzt4eSnd4PMMSmFi1zAltVWOpQ 2026-08-25 00:00:09+00:00|...

CVE-2026-7946

An insufficient policy enforcement flaw was found in the WebUI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=496016840...

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Deactivated Channel Members Retain Full Access to Group/DM Channels Affected Component Channel membership authorization check: - backend/openwebui/models/channels.py lines 663-673, isuserchannelmember - Used at 15 locations in backend/openwebui/routers/channels.py Affected Versions Current main...

GHSA-MQQ6-CQCX-38VG Open WebUI's Model Import Overwrites Any Model Without Ownership Check

Model Import Overwrites Any Model Without Ownership Check Affected Component Model import endpoint: - backend/openwebui/routers/models.py lines 254-308, importmodels Affected Versions Current main branch commit 6fdd19bf1 and likely all versions with model import functionality. Description The POS...

GHSA-C7WP-3QH5-55PV Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels

Missing Access Check on Channel Members Endpoint for Standard Channels Affected Component Channel members listing endpoint: - backend/openwebui/routers/channels.py lines 445-507, getchannelmembersbyid Affected Versions Current main branch and likely all versions with the channels feature...

NPM: open-webui Vulnerable to Stored XSS via Model Description

NPM: open-webui Vulnerable to Stored XSS via Model Description vulnerability discovered by ? in WordPress Npm open-webui versions = 0.8.12...

CVE-2026-41313 vulnerabilities

Vulnerabilities for packages: open-webui, nemo, litellm...

CVE-2026-41182 vulnerabilities

Vulnerabilities for packages: langfuse, open-webui, kibana, librechat, langfuse-fips...

CVE-2026-42215 vulnerabilities

Vulnerabilities for packages: opal, awx, open-webui, datahub-ingestion-fips, mlflow, mlflow-fips, checkov...

CVE-2026-41314 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-20035: Server-Side Request Forgery (SSRF)

A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by...

PT-2026-41492

Summary The kanidmd web UI renders the WebAuthn passkey-registration challenge as raw JSON inside an inline element using the Askama |safe filter. The challenge embeds the account's displayname, which serde json serialises without escaping . A displayname containing therefore terminates the scrip...

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display

Impact In the Prometheus server's legacy web UI enabled via the command-line flag --enable-feature=old-ui, the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics e.g. via a...

CVE-2026-44569

creationtimestamp| type| source ---|---|--- 2026-05-05 20:20:01+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jxwr-g6r6-j3fx...

CVE-2026-44566

creationtimestamp| type| source ---|---|--- 2026-05-05 15:44:20+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-9pgh-j74g-qj6m...

PT-2026-41403

Summary ciguard's FastAPI Web UI src/ciguard/web/app.py does not set HTTP defence-in-depth headers. OWASP ZAP baseline scan flagged 11 alerts: missing Content-Security-Policy Medium, X-Frame-Options Medium, Sub-Resource-Integrity on /api/docs Medium, COOP / COEP / CORP Low, Permissions-Policy Low...

Google Chrome 安全漏洞

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 148.0.7778.96 contained a security vulnerability. This vulnerability stemmed from insufficient execution of WebUI policies, which could allow remote attackers with access to the rendering process to bypass...

GHSA-RPFR-X88X-XWCW Pelican Web UI Affected by a Privilege Escalation Attack

Background On April 2nd, 2026, a Claude coding agent alerted Pelican PI Brian Bockelman to a privilege escalation vulnerability affecting Pelican's Web User Interface WebUI for various versions between v7.21 and v7.24. Upon further investigation, the Pelican team discovered this attack allows any...

DEBIAN-CVE-2026-42052

Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode for untrusted metadata fields. In this runtime, is raw insertion and HTML escaping is only performed by . Rendered output is then inserted with .html..., allowing...