Known vulnerabilities in Open WebUI - page 3

Vendor: Open WebUI
Software: Open WebUI
Software CPE: cpe:2.3:a:open_webui:ollama_webui:*:*:*:*:*:*:*:*
Total vulnerabilities: 161
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Open WebUI Open WebUI is affected by 161 known vulnerabilities: 6 high, 27 medium, 128 low Critical High Medium Low

Vulnerabilities (161)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU140763 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-54020
CWE-367 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140762 - Missing Authorization
CVE-2026-70487
CWE-862 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140761 - Authorization Bypass Through User-Controlled Key
CVE-2026-70488
CWE-639 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU140760 - Incorrect Authorization
CVE-2026-70490
CWE-863 Low
No
No
0.11.0 03.08.2026 SB2026080325
#VU136849 - Protection Mechanism Failure
CVE-2026-59223
CWE-693 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU136848 - Authentication Bypass by Spoofing
CVE-2026-59224
CWE-290 Medium
No
No
0.10.0 03.07.2026 SB2026063040
#VU136847 - Authorization Bypass Through User-Controlled Key
CVE-2026-59215
CWE-639 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU136846 - Improper Access Control
CVE-2026-59213
CWE-284 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU136845 - Incorrect Authorization
CVE-2026-59212
CWE-863 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU136844 - Missing Authentication for Critical Function
CVE-2026-59715
CWE-306 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU136843 - Missing Authorization
CVE-2026-59714
CWE-862 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU136842 - Improper Authorization
CVE-2026-59219
CWE-285 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU136841 - Missing Authorization
CVE-2026-59216
CWE-862 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU136840 - Missing Authorization
CVE-2026-59217
CWE-862 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU135958 - Information Exposure Through Timing Discrepancy
CVE-2026-59218
CWE-208 Medium
No
No
0.10.0 30.06.2026 SB2026063040
#VU135957 - Inefficient Regular Expression Complexity
CVE-2026-59220
CWE-1333 Low
No
No
0.10.0 30.06.2026 SB2026063040
#VU135956 - Incorrect Authorization
CVE-2026-59227
CWE-863 Low
No
No
0.10.0 30.06.2026 SB2026063040
#VU135954 - Improper Authorization
CVE-2026-59226
CWE-285 Low
No
No
0.10.0 30.06.2026 SB2026063040
#VU135955 - Incorrect Authorization
CWE-863 Low
No
No
0.10.0 30.06.2026 SB2026063040
#VU135953 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-59214
CWE-79 Low
No
No
0.10.0 30.06.2026 SB2026063040


Showing elements 41 - 60 out of 161