Known vulnerabilities in Open WebUI - page 2

Vendor: Open WebUI
Software: Open WebUI
Software CPE: cpe:2.3:a:open_webui:ollama_webui:*:*:*:*:*:*:*:*
Total vulnerabilities: 161
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Open WebUI Open WebUI is affected by 161 known vulnerabilities: 6 high, 27 medium, 128 low Critical High Medium Low

Vulnerabilities (161)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU152703 - Incorrect Authorization
CVE-2026-88006
CWE-863 Medium
No
No
0.11.1 28.09.2026 SB2026083135
#VU152702 - Improper Neutralization of Wildcards or Matching Symbols
CVE-2026-87016
CWE-155 High
No
No
0.11.1 28.09.2026 SB2026083135
#VU152701 - Insertion of Sensitive Information Into Sent Data
CVE-2026-87015
CWE-201 Medium
No
No
0.11.1 28.09.2026 SB2026083135
#VU152700 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2026-87013
CWE-835 Low
No
No
0.11.1 28.09.2026 SB2026083135
#VU152699 - Improper Validation of Specified Type of Input
CVE-2026-87012
CWE-1287 Low
No
No
0.11.1 28.09.2026 SB2026083135
#VU152698 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-87996
CWE-367 Low
No
No
0.11.1 28.09.2026 SB2026083135
#VU152697 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-87995
CWE-79 Low
No
No
0.11.1 28.09.2026 SB2026083135
#VU140759 - Missing Authorization
CVE-2026-70484
CWE-862 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140758 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-70492
CWE-79 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140757 - Server-Side Request Forgery (SSRF)
CVE-2026-70480
CWE-918 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140756 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-70486
CWE-79 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140755 - Exposure of sensitive information to an unauthorized actor
CVE-2026-70491
CWE-200 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140754 - Missing Authorization
CVE-2026-70483
CWE-862 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140753 - Incorrect Authorization
CVE-2026-70494
CWE-863 Medium
No
No
0.11.0 03.08.2026 SB2026080325
#VU140752 - Server-Side Request Forgery (SSRF)
CVE-2026-70479
CWE-918 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140751 - Server-Side Request Forgery (SSRF)
CVE-2026-70485
CWE-918 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140750 - Missing Authorization
CVE-2026-70481
CWE-862 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140749 - Resource exhaustion
CVE-2026-70489
CWE-400 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140748 - Inefficient Regular Expression Complexity
CVE-2026-70493
CWE-1333 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140747 - Improper Authentication
CVE-2026-70482
CWE-287 High
No
No
0.11.0 03.08.2026 SB2026080325


Showing elements 21 - 40 out of 161