5236 matches found
PT-2025-49046
Name of the Vulnerable Software and Affected Versions open-webui version 0.6.33 Description The software contains a flaw related to access control. The /api/tasks/stop/ API endpoint allows direct access and cancellation of tasks without verifying user ownership. This enables an attacker, even a...
CVE-2025-63681
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
CVE-2025-65959: Improper Neutralization of Input During Web Page Generation
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing...
CVE-2025-65958: Server-Side Request Forgery (SSRF)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery SSRF vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to...
Open WebUI 跨站脚本漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site scripting vulnerability exists in versions of Open WebUI prior to 0.6.37 that stems from a stored cross-site scripting attack that could lead to arbitrary JavaScript execution and...
CVE-2025-63681
Open-WebUI CVE-2025-63681 affects v0.6.33. The API endpoint /api/tasks/stop/ allows direct cancellation of tasks without verifying ownership, enabling a normal user to stop arbitrary LLM response tasks (Incorrect Access Control). Base score 4.3 (Medium); attack vector NETWORK, privileges required...
PT-2025-49146
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.37 Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. A Stored Cross-Site Scripting XSS issue was identified in the Notes PDF download functionality. ...
PT-2025-49128
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.37 Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. A Server-Side Request Forgery SSRF vulnerability in Open WebUI allows any authenticated user to...
CVE-2025-63681
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
CVE-2025-63681: Improper Access Control
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
Open WebUI 代码问题漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A code issue vulnerability exists in versions of Open WebUI prior to 0.6.37 that stems from server-side request forgery and could lead to access to internal networks and services...
CVE-2025-63681
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
Malicious code in @bingads-webui-clientcenter/instrumentation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7efd2376e1aa13253ea637d39c491337b642dec3198639e7b492c1aec1c083ad The package @bingads-webui-clientcenter/instrumentation was found to contain malicious code...
EUVD-2025-200015
Malicious code in @bingads-webui-clientcenter/instrumentation npm...
MAL-2025-191495 Malicious code in @bingads-webui-clientcenter/instrumentation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7efd2376e1aa13253ea637d39c491337b642dec3198639e7b492c1aec1c083ad The package @bingads-webui-clientcenter/instrumentation was found to contain malicious code...
GHSA-M449-CWJH-6PW7 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-M449-CWJH-6PW7 vulnerabilities
Vulnerabilities for packages: nemo, open-webui...
CVE-2025-65106 vulnerabilities
Vulnerabilities for packages: open-webui...