CVE-2026-85701 ramon-victor freegpt-webui Authentication Check __init__.py ChatCompletion.create missing authentication

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/init.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

PT-2026-86259

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing...

PT-2026-86260

A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be...

PT-2026-86253

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/ init .py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

PT-2026-86262

CVE-2026-85704: Race condition in Freegpt Webui Jailbreak Mode, server/config.py allows remote attacks, but high complexity makes exploitation difficult. CVSS 3.7. Public exploit exists. No patch available. Update or monitor POC available https://t.co/2oFcukN71V valtersit CVE CVEAlert infosec...

CVE-2026-66393 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.13-sdk, apache-beam-python-3.11-sdk, open-webui, label-studio, apache-beam-python-3.12-sdk, nemo, kubeflow-pipelines-visualization-server, py3-nltk...

GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.13-sdk, apache-beam-python-3.11-sdk, open-webui, label-studio, apache-beam-python-3.12-sdk, nemo, kubeflow-pipelines-visualization-server, py3-nltk...

CVE-2026-66393 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, open-webui, py3-nltk...

GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, open-webui, py3-nltk...

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data.

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...

CVE-2026-13337

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui...

CVE-2026-13337

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui...

CVE-2026-13337

NetBotz by Schneider Electric is affected by a Hibernate ORM vulnerability (CWE-564) that permits injection of a malicious HQL query into the device's database. The attack surface is the web-service interface or webui , requiring a low-privilege authenticated session. The CVSS 4.0 score is 5.1 (M...

GHSA-FFG3-P8FM-MJX2 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-55830 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-55830 vulnerabilities

Vulnerabilities for packages: open-webui, litellm...

GHSA-FFG3-P8FM-MJX2 vulnerabilities

Vulnerabilities for packages: open-webui, litellm...

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data.

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

CVE-2026-82288

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-82288 Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...