arches-containers (>=1.1.0a1, <=1.1.3rc1), arthexis (>=0.1.14, <=0.1.30) +14 more potentially affected by CVE-2026-32274 via black (25.9.0)

black PYPI version 25.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - arches-containers =1.1.0a1, =0.1.14, =19.0.7, =0.1.48, =0.0.59, =0.1.2, =2.179.0, =0.0.1, =1.7.0, =2025.35.0, =2026.55.0 and more Source cves:...

arches-containers (>=1.1.0a1, <=1.1.3rc1), arthexis (>=0.1.14, <=0.1.30) +14 more potentially affected by CVE-2026-31900 via black (25.9.0)

black PYPI version 25.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - arches-containers =1.1.0a1, =0.1.14, =19.0.7, =0.1.48, =0.0.59, =0.1.2, =2.179.0, =0.0.1, =1.7.0, =2025.35.0, =2026.55.0 and more Source cves:...

arthexis (>=0.1.31, <=0.1.34), dismo (0.2.43) +6 more potentially affected by CVE-2026-31900 via black (25.11.0)

black PYPI version 25.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - arthexis =0.1.31, =2.184.0, =1.59.0, =0.2.4, =1.0.0rc1, =1.0.0 - qtbmodels 0.1.0 Source cves: CVE-2026-31900 Source advisory: OSV:PYSEC-2026-2120...

EUVD-2026-11145

A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaaportalauthlocalsubmit. The manipulation of the argument suffix results in command injection. The attack can be launched remotely. The exploit has been made public and could be used...

CVE-2025-15603

A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/startwindows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUISECRETKEY leads to insufficiently random values. It is possible to launch the attack...

CVE-2026-3943: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaaportalauthlocalsubmit. The manipulation of the argument suffix results in command injection. The attack can be launched remotely. The exploit has been made public and could be used...

EUVD-2025-208452

A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file backend/startwindows.bat of the component JWT Key Handler. Such manipulation of the argument WEBUISECRETKEY leads to insufficiently random values. It is possible to launch the attack...

GHSA-2RF6-9RC8-RQCH Withdrawn Advisory: Open WebUI JWT Key Handler

Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file...

Withdrawn Advisory: Open WebUI JWT Key Handler

Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description A security vulnerability has been detected in open-webui up to 0.6.16. Affected is an unknown function of the file...

CVE-2025-15603

Open WebUI up to version 0.6.16 is reported to contain a security issue in the JWT Key Handler, specifically in the file backend/start_windows.bat. Manipulating the WEBUI_SECRET_KEY argument can lead to insufficient randomness in keys, potentially enabling remote exploitation. Multiple connected ...

CVE-2025-15603

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, startwindows.ba...

CVE-2025-15603

...

Open WebUI Security Feature Vulnerability

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI with open-source code. Versions of Open WebUI prior to 0.6.16 have a security vulnerability related to the parameter WEBUISECRETKEY, where insufficient randomness was present in the handling of this parameter...

GHSA-2G6R-C272-W58R vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-28351 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-F2V5-7JQ9-H8CG vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-F2V5-7JQ9-H8CG vulnerabilities

Vulnerabilities for packages: open-webui, nemo, litellm...

gryannote (>=0.3.1, <=0.3.3), scraibe-webui (0.1.0) potentially affected by CVE-2026-28416 via gradio (4.27.0)

gradio PYPI version 4.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gryannote =0.3.1, =0.3.3 - scraibe-webui 0.1.0 Source cves: CVE-2026-28416 Source advisory: OSV:GHSA-JMH7-G254-2CQ9...

autobiasdetector (0.0.2), chat-with-mlx (>=0.2.0, <=0.2.2) +6 more potentially affected by CVE-2026-28416 via gradio (4.29.0)

gradio PYPI version 4.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - autobiasdetector 0.0.2 - chat-with-mlx =0.2.0, =0.1.1, =0.0.1, =0.0.1, =1.3.0, =1.4.3 Source cves: CVE-2026-28416 Source advisory:...

gradio-picto-gallery (0.0.8), scraibe-webui (>=0.1.2.dev107, <=0.2.1) +1 more potentially affected by CVE-2026-28416 via gradio (5.5.0)

gradio PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gradio-picto-gallery 0.0.8 - scraibe-webui =0.1.2.dev107, =0.2.1 - tts-webui 0.0.1 Source cves: CVE-2026-28416 Source advisory: OSV:GHSA-JMH7-G254-2...