Known vulnerabilities in Open WebUI

Vendor: Open WebUI
Software: Open WebUI
Software CPE: cpe:2.3:a:open_webui:ollama_webui:*:*:*:*:*:*:*:*
Total vulnerabilities: 161
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Open WebUI Open WebUI is affected by 161 known vulnerabilities: 6 high, 27 medium, 128 low Critical High Medium Low

Vulnerabilities (161)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU152714 - Missing Authorization
CWE-862 Low
No
No
0.11.4 28.09.2026 SB20260928431
#VU152713 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
0.11.4 28.09.2026 SB20260928431
#VU152712 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
0.11.4 28.09.2026 SB20260928431
#VU152711 - Authorization Bypass Through User-Controlled Key
CWE-639 Low
No
No
0.11.4 28.09.2026 SB20260928431
#VU152710 - Origin Validation Error
CWE-346 High
No
No
0.11.4 28.09.2026 SB20260928431
#VU152709 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
0.11.4 28.09.2026 SB20260928431
#VU152708 - Insufficient Session Expiration
CWE-613 Low
No
No
0.11.4 28.09.2026 SB20260928431
#VU152707 - Incorrect Authorization
CWE-863 Low
No
No
0.11.4 28.09.2026 SB20260928431
#VU152706 - Missing Authorization
CWE-862 Low
No
No
0.11.4 28.09.2026 SB20260928431
#VU152705 - Incorrect Authorization
CWE-863 Low
No
No
0.11.4 28.09.2026 SB20260928431
#VU152704 - Exposure of sensitive information to an unauthorized actor
CWE-200 Low
No
No
0.11.4 28.09.2026 SB20260928431
#VU152696 - Authorization Bypass Through User-Controlled Key
CVE-2026-87994
CWE-639 Low
No
No
0.11.1 28.09.2026 SB2026083135
#VU152695 - Incorrect Authorization
CVE-2026-87017
CWE-863 Low
No
No
0.11.1 28.09.2026 SB2026083135
#VU146344 - Incorrect Authorization
CVE-2026-87998
CWE-863 Low
No
No
0.11.1 31.08.2026 SB2026083135
#VU146343 - Authorization Bypass Through User-Controlled Key
CVE-2026-87997
CWE-639 Low
No
No
0.11.1 31.08.2026 SB2026083135
#VU146342 - Server-Side Request Forgery (SSRF)
CVE-2026-87999
CWE-918 Low
No
No
0.11.1 31.08.2026 SB2026083135
#VU146341 - Server-Side Request Forgery (SSRF)
CVE-2026-88001
CWE-918 Low
No
No
0.11.1 31.08.2026 SB2026083135
#VU146340 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-88000
CWE-835 Low
No
No
0.11.1 31.08.2026 SB2026083135
#VU146339 - Incorrect Authorization
CVE-2026-88005
CWE-863 Medium
No
No
0.11.1 31.08.2026 SB2026083135
#VU146338 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-88002
CWE-835 Low
No
No
0.11.1 31.08.2026 SB2026083135


Showing elements 1 - 20 out of 161