5955 matches found
CVE-2026-34222
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11...
CVE-2026-34222 Open WebUI has Broken Access Control in Tool Valves
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11...
openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-34222 via open-webui (0.6.0)
open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-34222 Source advisory: MEND:CVE-2026-34222...
CVE-2026-34222
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11...
CVE-2026-34222 Open WebUI has Broken Access Control in Tool Valves
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11...
CVE-2026-34222
Affected product: Open WebUI, a self-hosted offline AI platform. Issue: broken access control in tool values prior to version 0.8.11. Impact: potential exposure due to access control bypass; CVSS 3.1 base score 7.7 (HIGH) with Network attack vector, low privileges required, no user interaction, c...
CVE-2026-34222: Improper Authorization
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11...
PT-2026-29571
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.8.11 Description A broken access control issue exists in Open WebUI, specifically in tool values. This allows low-privileged attackers to access sensitive Tool data. Recommendations Update to version 0.8.11 or...
ai-blackteam (>=0.3.0, <=1.7.1), aurapro-ui (>=3.1.0, <=3.9.3) +10 more potentially affected by CVE-2026-34450 via anthropic (0.86.0)
anthropic PYPI version 0.86.0 is affected by a known vulnerability. The following packages have a transitive dependency on anthropic and may be impacted: - ai-blackteam =0.3.0, =3.1.0, =0.2.2, =0.8.2, =0.8.11, =0.1.8, =2.4.0, =0.2.0, =0.1.0, =2.8.5, =2.9.7 Source cves: CVE-2026-34450 Source...
CVE-2025-14213 Cato's Socket WebUI is vulnerable to OS Command Injection
Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface UI to execute arbitrary operating system commands as the root user on the Socket’s internal system...
CVE-2025-14213
Cato Networks Socket WebUI (versions prior to 25) is affected by an OS command injection vulnerability. An authenticated attacker with access to the Socket web interface can run arbitrary OS commands as root on the Socket’s internal system. The issue is network-exposed with low attack complexity,...
CVE-2026-33699 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-33123 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-QPXP-75PX-XJCP vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-87MJ-5GGW-8QC3 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-87MJ-5GGW-8QC3 vulnerabilities
Vulnerabilities for packages: open-webui...
📄 lollms-webui Server-Side Request Forgery
A critical server-side request forgery vulnerability has been identified in lollms-webui, the web interface for Lord of Large Language and Multi modal Systems. The @router.post"/api/proxy" endpoint allows unauthenticated attackers to force the server into making arbitrary GET requests. This can b...
EUVD-2026-17081
A Cross-Site Request Forgery CSRF vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service DoS condition in the Fireware Web UI by convincing an authenticated administrator into visiting a malicious web page.This issue affects Fireware OS: 11....
CVE-2026-4315
A Cross-Site Request Forgery CSRF vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service DoS condition in the Fireware Web UI by convincing an authenticated administrator into visiting a malicious web page...
CVE-2026-4315
A Cross-Site Request Forgery CSRF vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service DoS condition in the Fireware Web UI by convincing an authenticated administrator into visiting a malicious web page...