open-webui

Top products

The 15 most recently published vulnerabilities affecting open-webui.

• CVE-2026-56399Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web5.0Jun 30, 2026
• CVE-2026-54007Open WebUI: Cross-origin postMessage confirmation bypass via action:submit6.5Jun 23, 2026
• CVE-2026-54006Open WebUI: Calendar event re-parenting allows writing events into another user's calendar4.3Jun 23, 2026
• CVE-2026-54008Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`8.5Jun 23, 2026
• CVE-2026-54009Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field6.5Jun 23, 2026
• CVE-2026-54010Open WebUI: Forged chat-file link allows cross-user file read and deletion8.3Jun 23, 2026
• CVE-2026-54011Open WebUI: Stored XSS in Mermaid Markdown Preview8.7Jun 23, 2026
• CVE-2026-54012Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion7.1Jun 23, 2026
• CVE-2026-54013Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI7.6Jun 23, 2026
• CVE-2026-54014Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui4.3Jun 23, 2026
• CVE-2026-54015Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion6.4Jun 23, 2026
• CVE-2026-54016Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration4.3Jun 23, 2026
• CVE-2026-54018Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects7.7Jun 23, 2026
• CVE-2026-54019Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode6.5Jun 23, 2026
• CVE-2026-54021Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter6.3Jun 23, 2026