CVE-2026-85703: Allocation of Resources Without Limits or Throttling

A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be...

CVE-2026-66393 vulnerabilities

Vulnerabilities for packages: nemo, py3-nltk, apache-beam-python-3.12-sdk, label-studio, apache-beam-python-3.11-sdk, open-webui, kubeflow-pipelines-visualization-server, apache-beam-python-3.13-sdk...

GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: nemo, py3-nltk, apache-beam-python-3.12-sdk, label-studio, apache-beam-python-3.11-sdk, open-webui, kubeflow-pipelines-visualization-server, apache-beam-python-3.13-sdk...

CVE-2026-66393 vulnerabilities

Vulnerabilities for packages: py3-nltk, open-webui, kubeflow-pipelines-visualization-server...

GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: py3-nltk, open-webui, kubeflow-pipelines-visualization-server...

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data.

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...

CVE-2026-13337

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui...

CVE-2026-13337

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui...

CVE-2026-13337

NetBotz by Schneider Electric is affected by a Hibernate ORM vulnerability (CWE-564) that permits injection of a malicious HQL query into the device's database. The attack surface is the web-service interface or webui , requiring a low-privilege authenticated session. The CVSS 4.0 score is 5.1 (M...

CVE-2026-13337: SQL Injection: Hibernate

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui...

CVE-2026-55830 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-FFG3-P8FM-MJX2 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-55830 vulnerabilities

Vulnerabilities for packages: open-webui, litellm...

GHSA-FFG3-P8FM-MJX2 vulnerabilities

Vulnerabilities for packages: open-webui, litellm...

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data.

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-89178

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.11.0 Description An authenticated user can perform a Server-Side Request Forgery SSRF attack when the AIOHTTP CLIENT ALLOW REDIRECTS variable is set to true. The platform fails to reapply the WEB FETCH FILTE...

PT-2026-89179

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.5.0 through 0.11.0 Description A flaw exists in the message-chain reconstruction helper located in backend/open webui/utils/misc.py. The system reconstructs chat history by map key but tracks visited entries using an...

CVE-2026-82288

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-82288

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

CVE-2026-82288 Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...