4467 matches found
CVE-2026-41425 vulnerabilities
Vulnerabilities for packages: datahub-ingestion, pgadmin4-fips, mlflow, airflow, open-webui, datahub-ingestion-fips...
CVE-2026-7946
Insufficient policy enforcement in WebUI in Google Chrome on Linux, Mac, Windows, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-7946
Insufficient policy enforcement in WebUI in Google Chrome on Linux, Mac, Windows, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-7946
Insufficient policy enforcement in WebUI in Google Chrome on Linux, Mac, Windows, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-7946
Insufficient policy enforcement in WebUI in Google Chrome on Linux, Mac, Windows, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-7946
Insufficient policy enforcement in WebUI in Google Chrome on Linux, Mac, Windows, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...
PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI
Summary pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/ is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception for example by requesting a...
Information Exposure
Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Information Exposure via the global exception handling process in the WebUI. An attacker can obtain sensitive internal implementation details, such as stack...
CVE-2026-41481 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-41313 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-41168 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-41312 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-41182 vulnerabilities
Vulnerabilities for packages: langfuse, open-webui...
CVE-2026-42215 vulnerabilities
Vulnerabilities for packages: open-webui, mlflow, checkov...
CVE-2026-42284 vulnerabilities
Vulnerabilities for packages: open-webui, mlflow, checkov...
CVE-2026-41205 vulnerabilities
Vulnerabilities for packages: airflow, jupyter-base-notebook, superset, mlflow, open-webui...
CVE-2026-41425 vulnerabilities
Vulnerabilities for packages: airflow, mlflow, open-webui...
PT-2026-38289
Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev100 Description The WebUI returns full Python traceback details to clients when unhandled exceptions occur. This happens because the endpoint "/web/" is accessible without authentication and renders template...
CVE-2026-44565
creationtimestamp| type| source ---|---|--- 2026-05-05 13:19:17+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-j3fw-wc48-29g3 2026-05-15 01:35:17+00:00| seen|...