PT-2026-86260

A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be...

PT-2026-86262

CVE-2026-85704: Race condition in Freegpt Webui Jailbreak Mode, server/config.py allows remote attacks, but high complexity makes exploitation difficult. CVSS 3.7. Public exploit exists. No patch available. Update or monitor POC available https://t.co/2oFcukN71V valtersit CVE CVEAlert infosec...

CVE-2026-85703: Allocation of Resources Without Limits or Throttling

A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be...

PT-2026-89159

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An issue exists in the calendar event model within backend/open webui/models/calendar.py where the meta.alert minutes value is stored without type validation. Because the shared upcoming-eve...

PT-2026-89160

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An authenticated user can create a parent cycle by placing a folder under itself or one of its descendants. This occurs because the system does not validate that the new parent is not the...

CVE-2026-85702: Missing Authentication for Critical Function

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing...

PT-2026-86259

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing...

PT-2026-86253

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/ init .py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

CVE-2026-85704: Concurrent Execution using Shared Resource with Improper Synchronization

A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak of the file server/config.py of the component Jailbreak Mode. The manipulation results in race condition. It is possible to launch the...

PT-2026-89161

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An issue exists where role synchronization fails to invalidate cached user records during a privilege demotion. When an administrator is demoted via a trusted role header or OAuth role...

CVE-2026-85701: Missing Authentication for Critical Function

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/init.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

CVE-2026-66393 vulnerabilities

Vulnerabilities for packages: label-studio, nemo, apache-beam-python-3.11-sdk, open-webui, kubeflow-pipelines-visualization-server, py3-nltk, apache-beam-python-3.13-sdk, apache-beam-python-3.12-sdk...

GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: label-studio, nemo, apache-beam-python-3.11-sdk, open-webui, kubeflow-pipelines-visualization-server, py3-nltk, apache-beam-python-3.13-sdk, apache-beam-python-3.12-sdk...

CVE-2026-66393 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3-nltk, open-webui...

GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3-nltk, open-webui...

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data.

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...

CVE-2026-13337

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui...

CVE-2026-13337

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui...

CVE-2026-13337

NetBotz by Schneider Electric is affected by a Hibernate ORM vulnerability (CWE-564) that permits injection of a malicious HQL query into the device's database. The attack surface is the web-service interface or webui , requiring a low-privilege authenticated session. The CVSS 4.0 score is 5.1 (M...

CVE-2026-13337: SQL Injection: Hibernate

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui...