Vulnerability index

Browse CVEs

116 matching
Filters 1 Clear all
Severity

Filters apply as you choose them.

Open Webui CRITICAL 9.6
CVE-2026-56400

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated …

Fix: 0.3.14+
Fix from $2,300 2026-07-15
Open Webui CRITICAL 9.0
CVE-2026-56398

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type i…

Fix: 0.9.5+
Fix from $2,300 2026-07-15
Open Webui HIGH 7.7
CVE-2026-59221

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_…

Patch available
Fix from $1,950 2026-07-09
Open Webui MEDIUM 6.5
CVE-2026-59715

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured w…

Fix: 0.10.0+
Fix from $1,600 2026-07-09
Open Webui MEDIUM 5.4
CVE-2026-59227

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /api/v1/images/edit required on…

Fix: 0.10.0+
Fix from $1,600 2026-07-09
Open Webui HIGH 8.0
CVE-2026-59224

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built …

Fix: 0.10.0+
Fix from $1,950 2026-07-09
Open Webui MEDIUM 6.5
CVE-2026-59220

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.2 before 0.10.0, the SKILL_MENTION_RE and strip_re reg…

Fix: 0.10.0+
Fix from $1,600 2026-07-09
Open Webui MEDIUM 6.5
CVE-2026-59222

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returne…

Fix: 0.10.0+
Fix from $1,600 2026-07-09
Open Webui MEDIUM 6.3
CVE-2026-59225

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with…

Fix: 0.10.0+
Fix from $1,600 2026-07-09
Open Webui CRITICAL 9.0
CVE-2026-59214

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodid…

Fix: 0.10.0+
Fix from $2,300 2026-07-09
Open Webui CRITICAL 9.0
CVE-2026-59216

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and ex…

Fix: 0.10.0+
Fix from $2,300 2026-07-09
Open Webui HIGH 7.1
CVE-2026-59219

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO conne…

Fix: 0.10.0+
Fix from $1,950 2026-07-09
Open Webui MEDIUM 5.3
CVE-2026-59218

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the /api/v1/auths/signin endpoint looked users…

Fix: 0.10.0+
Fix from $1,600 2026-07-09
Open Webui MEDIUM 5.0
CVE-2026-59213

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/o…

Fix: 0.10.0+
Fix from $1,600 2026-07-09
Open Webui MEDIUM 5.4
CVE-2026-59212

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_knowledge_file_access only ch…

Patch available
Fix from $1,600 2026-07-09
Open Webui HIGH 7.7
CVE-2026-54018

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implem…

Fix: 0.9.6+
Fix from $1,950 2026-06-23
Open Webui MEDIUM 6.5
CVE-2026-54019

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level …

Fix: 0.9.6+
Fix from $1,600 2026-06-23
Open Webui MEDIUM 6.3
CVE-2026-54021

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, several direct, index-addressed Ol…

Fix: 0.9.6+
Fix from $1,600 2026-06-23
Open Webui MEDIUM 5.3
CVE-2026-54022

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the ydoc:document:join Socket.IO …

Fix: 0.8.11+
Fix from $1,600 2026-06-23
Open Webui HIGH 8.3
CVE-2026-54010

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated u…

Fix: 0.9.6+
Fix from $1,950 2026-06-23
Open Webui HIGH 7.6
CVE-2026-54013

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user…

Fix: 0.9.6+
Fix from $1,950 2026-06-23
Open Webui HIGH 7.1
CVE-2026-54012

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can cre…

Fix: 0.9.6+
Fix from $1,950 2026-06-23
Open Webui MEDIUM 6.5
CVE-2026-54009

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/chat/completions accepts…

Fix: 0.9.6+
Fix from $1,600 2026-06-23
Open Webui MEDIUM 6.4
CVE-2026-54015

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-histor…

Fix: 0.9.6+
Fix from $1,600 2026-06-23
Open Webui MEDIUM 5.4
CVE-2026-54011

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6,Open WebUI renders Mermaid blocks f…

Fix: 0.9.6+
Fix from $1,600 2026-06-23
Open Webui HIGH 8.5
CVE-2026-54008

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backend/open_webui/utils/oauth.py:…

Fix: 0.9.6+
Fix from $1,950 2026-06-23
Open Webui MEDIUM 6.5
CVE-2026-54007

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows n…

Fix: 0.9.6+
Fix from $1,600 2026-06-23
Open Webui HIGH 7.7
CVE-2026-54017

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the terminal-server reverse proxy …

Fix: 0.9.6+
Fix from $1,950 2026-06-18
Open Webui MEDIUM 6.5
CVE-2026-45666

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the API /api/v1/notes/{note_id} e…

Fix: 0.8.11+
Fix from $1,600 2026-05-15
Open Webui MEDIUM 6.5
CVE-2026-45667

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, GET /api/v1/memories/ef is accessi…

Fix: 0.8.0+
Fix from $1,600 2026-05-15