5962 matches found
ai-blackteam (>=0.3.0, <=1.7.1), aurapro-ui (>=3.1.0, <=3.9.3) +10 more potentially affected by CVE-2026-34450 via anthropic (0.86.0)
anthropic PYPI version 0.86.0 is affected by a known vulnerability. The following packages have a transitive dependency on anthropic and may be impacted: - ai-blackteam =0.3.0, =3.1.0, =0.2.2, =0.8.2, =0.8.11, =0.1.8, =2.4.0, =0.2.0, =0.1.0, =2.8.5, =2.9.7 Source cves: CVE-2026-34450 Source...
Open WebUI has Broken Access Control in Tool Valves
Summary Broken Access Control in Tool Valves Open WebUI supports function calling through "Tools". Function calling allows an LLM to reliably connect to external tools and interact with external APIs. Exemplary use-cases include connecting to an internal knowledge base, retrieving emails from an...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-34222 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-34222 Source advisory: SNYK:PYTHON-OPENWEBUI-15922401...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-34222 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-34222 Source advisory: OSV:GHSA-7429-HXCV-268M...
Missing Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the Tool Valves endpoint. An attacker can obtain sensitive information, such as API keys for backend systems, by sending GET /api/v1/tools/id//valves requests using a low-privileged...
EUVD-2026-17977
Open WebUI has Broken Access Control in Tool Valves...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-34222 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-34222 Source advisory: GHSA-7429-HXCV-268M...
CVE-2026-34222
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11...
CVE-2026-34222 Open WebUI has Broken Access Control in Tool Valves
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-34222 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-34222 Source advisory: MEND:CVE-2026-34222...
CVE-2026-34222
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11...
CVE-2026-34222 Open WebUI has Broken Access Control in Tool Valves
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11...
CVE-2026-34222
Affected product: Open WebUI, a self-hosted offline AI platform. Issue: broken access control in tool values prior to version 0.8.11. Impact: potential exposure due to access control bypass; CVSS 3.1 base score 7.7 (HIGH) with Network attack vector, low privileges required, no user interaction, c...
CVE-2026-34222: Improper Authorization
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11...
PT-2026-29571
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.8.11 Description A broken access control issue exists in Open WebUI, specifically in tool values. This allows low-privileged attackers to access sensitive Tool data. Recommendations Update to version 0.8.11 or...
ai-blackteam (>=0.3.0, <=1.7.1), aurapro-ui (>=3.1.0, <=3.9.3) +10 more potentially affected by CVE-2026-34450 via anthropic (0.86.0)
anthropic PYPI version 0.86.0 is affected by a known vulnerability. The following packages have a transitive dependency on anthropic and may be impacted: - ai-blackteam =0.3.0, =3.1.0, =0.2.2, =0.8.2, =0.8.11, =0.1.8, =2.4.0, =0.2.0, =0.1.0, =2.8.5, =2.9.7 Source cves: CVE-2026-34450 Source...
CVE-2025-14213 Cato's Socket WebUI is vulnerable to OS Command Injection
Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface UI to execute arbitrary operating system commands as the root user on the Socket’s internal system...
CVE-2025-14213
Cato Networks Socket WebUI (versions prior to 25) is affected by an OS command injection vulnerability. An authenticated attacker with access to the Socket web interface can run arbitrary OS commands as root on the Socket’s internal system. The issue is network-exposed with low attack complexity,...
