Known vulnerabilities in Open WebUI - page 4

Vendor: Open WebUI
Software: Open WebUI
Software CPE: cpe:2.3:a:open_webui:ollama_webui:*:*:*:*:*:*:*:*
Total vulnerabilities: 161
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Open WebUI Open WebUI is affected by 161 known vulnerabilities: 6 high, 27 medium, 128 low Critical High Medium Low

Vulnerabilities (161)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU136852 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-59221
CWE-22 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU136851 - Missing Authorization
CVE-2026-59225
CWE-862 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU136850 - Exposure of sensitive information to an unauthorized actor
CVE-2026-59222
CWE-200 Low
No
No
0.10.0 03.07.2026 SB2026063040
#VU135952 - Server-Side Request Forgery (SSRF)
CVE-2026-54018
CWE-918 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU135951 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-54017
CWE-22 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU135949 - Improper Access Control
CVE-2026-54021
CWE-284 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU135948 - Origin Validation Error
CVE-2026-54007
CWE-346 High
No
No
0.9.6 30.06.2026 SB2026063039
#VU135947 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-54011
CWE-79 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU135946 - Authorization Bypass Through User-Controlled Key
CVE-2026-54006
CWE-639 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU135945 - Authorization Bypass Through User-Controlled Key
CVE-2026-54009
CWE-639 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU135944 - Server-Side Request Forgery (SSRF)
CVE-2026-54008
CWE-918 Medium
No
No
0.9.6 30.06.2026 SB2026063039
#VU135943 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-54013
CWE-79 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU135942 - Improper Neutralization of Special Elements in Data Query Logic
CVE-2026-54019
CWE-943 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU135941 - Authorization Bypass Through User-Controlled Key
CVE-2026-54010
CWE-639 Medium
No
No
0.9.6 30.06.2026 SB2026063039
#VU135940 - Missing Authorization
CVE-2026-54012
CWE-862 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU135939 - Authorization Bypass Through User-Controlled Key
CVE-2026-54015
CWE-639 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU135938 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-54014
CWE-22 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU135937 - Improper Access Control
CVE-2026-54016
CWE-284 Low
No
No
0.9.6 30.06.2026 SB2026063039
#VU130949 - Missing Authentication for Critical Function
CVE-2026-45397
CWE-306 Medium
No
No
0.9.5 11.05.2026 SB2026051165
#VU130948 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVE-2026-45396
CWE-915 Low
No
No
0.9.5 11.05.2026 SB2026051165


Showing elements 61 - 80 out of 161