5893 matches found
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44570 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44570 Source advisory: SNYK:PYTHON-OPENWEBUI-16691118...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44571 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44571 Source advisory: OSV:GHSA-JGJ3-R8HR-9PJW...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44571 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44571 Source advisory: SNYK:PYTHON-OPENWEBUI-16638672...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44571 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44571 Source advisory: GHSA-JGJ3-R8HR-9PJW...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44569 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44569 Source advisory: SNYK:PYTHON-OPENWEBUI-16690884...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44569 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44569 Source advisory: GHSA-JXWR-G6R6-J3FX...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44569 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44569 Source advisory: OSV:GHSA-JXWR-G6R6-J3FX...
Open WebUI's Insecure Message Access Breaks Authorization
Description There's an IDOR in the channels message management system that allows authenticated users to modify or delete any message within channels they have read access to. The vulnerability exists in the message update and delete endpoints, which implement channel-level authorization but...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44565 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44565 Source advisory: SNYK:PYTHON-OPENWEBUI-16691223...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44565 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44565 Source advisory: GHSA-J3FW-WC48-29G3...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-44565 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-44565 Source advisory: OSV:GHSA-J3FW-WC48-29G3...
Open WebUI Arbitrary File Write, Delete via Path Traversal
CONFIDENTIAL Vulnerability Disclosure Analysis Documentation ----------------------------------------------- Vulnerability Details --------------------- 1. Discoverer: Taylor Pennington of KoreLogic, Inc. 2. Date Submitted: June 11, 2024 3. Title: Open WebUI Arbitrary File Write, Delete via Path...
GHSA-J3FW-WC48-29G3 Open WebUI Arbitrary File Write, Delete via Path Traversal
CONFIDENTIAL Vulnerability Disclosure Analysis Documentation ----------------------------------------------- Vulnerability Details --------------------- 1. Discoverer: Taylor Pennington of KoreLogic, Inc. 2. Date Submitted: June 11, 2024 3. Title: Open WebUI Arbitrary File Write, Delete via Path...
Open WebUI has a CORS misconfiguration and session validation issue
GitHub Security Lab GHSL Vulnerability Report, open-webui: GHSL-2024-174, GHSL-2024-175 The GitHub Security Lab team has identified potential security vulnerabilities in open-webui. We are committed to working with you to help resolve these issues. In this report you will find everything you need...
Insufficient Session Expiration
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Insufficient Session Expiration via misconfiguration of the CORSMiddleware module and improper session management. An attacker can gain unauthorized access and execute arbitrary code by enticing an...
CVE-2026-44226: Generation of Error Message Containing Sensitive Information
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/ is reachable without authentication and renders attacker-controlled template names, an...
PT-2026-42528
GitHub Security Lab GHSL Vulnerability Report, open-webui: GHSL-2024-174, GHSL-2024-175 The GitHub Security Lab team has identified potential security vulnerabilities in open-webui. We are committed to working with you to help resolve these issues. In this report you will find everything you need...
PT-2026-39670
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.10 Description An issue exists where the application does not validate or sanitize the filename of uploaded audio files, deriving it directly from the original HTTP upload request. This allows users to include...
