CVE-2026-91735

Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-83431

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite component: WebUI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench. Successf...

EUVD-2026-79729

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite component: WebUI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench. Successf...

CVE-2026-83431

Oracle Product Workbench (component: WebUI ) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is affected by a medium-severity vulnerability (CVSS 3.1: 5.4 ). A low-privileged attacker with network access via HTTP can exploit the flaw, but user interaction from a third party is required...

CVE-2026-84311 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-84309 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-23W6-3W8W-8484 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-JP53-MHQP-8XCG vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-84310 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-763M-79HH-57F2 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-84309 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-23W6-3W8W-8484 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-763M-79HH-57F2 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-84310 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-84311 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-JP53-MHQP-8XCG vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-87013

creationtimestamp| type| source ---|---|--- 2026-09-11 00:35:38+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-8r35-5x5r-hv74 2026-09-11 15:31:47+00:00| seen| https://gist.github.com/alon710/b936d0e8b1b08a24ad813407363272e8...

CVE-2026-87012

creationtimestamp| type| source ---|---|--- 2026-09-11 00:35:36+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-v39v-59xw-j98g 2026-09-11 14:31:53+00:00| seen| https://gist.github.com/alon710/e350315aab7316ce10d2d2056b580adf...

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...