4350 matches found
CVE-2026-0765 Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability
Open WebUI PIP installfrontmatterrequirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists...
CVE-2026-0765 Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability
Open WebUI PIP installfrontmatterrequirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists...
Open WebUI Code Injection Vulnerability
Open WebUI is an open-source, scalable, feature-rich, and user-friendly self-hosted WebUI. Open WebUI has a code injection vulnerability, which stems from the lack of validation for the string provided by users in the loadtoolmodulebyid function. This vulnerability may lead to code injection and...
Open WebUI security vulnerabilities
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Open WebUI has a security vulnerability that stems from transmitting sensitive information in plaintext when handling credentials, which may lead to information leakage...
Open WebUI: Operating System Command Injection Vulnerability
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Open WebUI has a vulnerability related to operating system command injection. This vulnerability stems from the lack of validation for the strings provided by users in the...
CVE-2026-23949 vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, emissary, kubeflow-katib, superset, py3-setuptools, open-webui, py3-cassandra-medusa, pypy-3.10, datadog-agent, mlflow, pypy-3.11, semgrep, airflow, dask-kubernetes, kserve...
CVE-2026-0622
Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...
GHSA-58PV-8J8X-9VJ2 vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, emissary, kubeflow-katib, superset, py3-setuptools, open-webui, py3-cassandra-medusa, pypy-3.10, datadog-agent, mlflow, pypy-3.11, semgrep, airflow, dask-kubernetes, kserve...
GHSA-58PV-8J8X-9VJ2 vulnerabilities
Vulnerabilities for packages: pgadmin4, request-1276, ansible-operator, dbt-bigquery, py3-cassandra-medusa, kubeflow-katib, datadog-agent-fips, tensorflow-cpu-jupyter, opal, superset, awx, label-studio, localstack, airflow, tensorflow-gpu-jupyter, kubeflow-jupyter-web-app, authentik-fips,...
CVE-2026-0622
Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...
CVE-2026-0622 Open 5GS WebUI uses a hard-coded JWT signing key
Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...
CVE-2026-0622 Open 5GS WebUI uses a hard-coded JWT signing key
Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...
CVE-2026-0622
Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...
CVE-2026-0622
Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...
Open5GS WebUI uses a hard-coded secrets including JSON Web Token signing key
Overview The Open5GS WebUI component contains default hardcoded secrets used for security-sensitive operations, including JSON Web Token JWT signing. If these defaults are not changed, an attacker can forge valid authentication tokens and gain administrative access to the WebUI. This can result i...
CVE-2026-0622: Undefined Security Weakness
Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...
MAL-2026-347 Malicious code in @bingads-webui-theme-2018/theme-fluent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb7d2fe9b87a76a487939456a941121a5bcee7d7aa0ffa37f198f8216d1e64aa The package @bingads-webui-theme-2018/theme-fluent was found to contain malicious code. Source: ghsa-malware...
Malicious Package
Overview @bingads-webui-theme-2018/theme-fluent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...