Known vulnerabilities in Open WebUI - page 4

Vendor: Open WebUI
Software: Open WebUI
Software CPE: cpe:2.3:a:open_webui:ollama_webui:*:*:*:*:*:*:*:*
Total vulnerabilities: 134
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Open WebUI Open WebUI is affected by 134 known vulnerabilities: 4 high, 24 medium, 106 low Critical High Medium Low

Vulnerabilities (134)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU135950 - Improper Access Control
CVE-2026-54022
CWE-284 Low
No
No
0.8.11 30.06.2026 SB2026051164
#VU130959 - Improper Access Control
CVE-2026-45387
CWE-284 Low
No
No
0.9.5 11.05.2026 SB2026051165
#VU130952 - Missing Authorization
CVE-2026-45399
CWE-862 Low
No
No
0.9.0 11.05.2026 SB2026051158
#VU130947 - Improper Authorization
CVE-2026-45365
CWE-285 Low
No
No
0.8.11 11.05.2026 SB2026051164
#VU130946 - Server-Side Request Forgery (SSRF)
CVE-2026-45347
CWE-918 Low
No
No
0.5.11 11.05.2026 SB2026051163
#VU130945 - Authorization Bypass Through User-Controlled Key
CVE-2026-45349
CWE-639 Low
No
No
0.9.0 11.05.2026 SB2026051158
#VU130944 - Exposure of sensitive information to an unauthorized actor
CVE-2026-45351
CWE-200 Low
No
No
0.8.9 11.05.2026 SB2026051162
#VU130943 - Missing Authorization
CVE-2026-45350
CWE-862 Low
No
No
0.8.6 11.05.2026 SB2026051161
#VU130942 - Improper Authorization
CVE-2026-45345
CWE-285 Low
No
No
0.5.7 11.05.2026 SB2026051160
#VU130941 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2026-45346
CWE-80 Low
No
No
0.6.31 11.05.2026 SB2026051159
#VU130940 - Incorrect Authorization
CVE-2026-45339
CWE-863 Low
No
No
0.9.0 11.05.2026 SB2026051158
#VU130939 - Server-Side Request Forgery (SSRF)
CVE-2026-45338
CWE-918 Low
No
No
0.9.0 11.05.2026 SB2026051158
#VU130938 - Cross-Site Request Forgery (CSRF)
CVE-2026-45317
CWE-352 Low
No
No
0.9.3 11.05.2026 SB2026051156
#VU130937 - Improper Neutralization of Alternate XSS Syntax
CVE-2026-45314
CWE-87 Low
No
No
0.9.3 11.05.2026 SB2026051156
#VU130936 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45318
CWE-79 Low
No
No
0.9.3 11.05.2026 SB2026051156
#VU130935 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45315
CWE-79 Low
No
No
0.9.3 11.05.2026 SB2026051156
#VU130932 - Incorrect Authorization
CVE-2026-45316
CWE-863 Low
No
No
0.9.3 11.05.2026 SB2026051156
#VU130931 - Improper Access Control
CVE-2026-45301
CWE-284 Medium
No
No
0.3.16 11.05.2026 SB2026051155
#VU130930 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45303
CWE-79 Low
No
No
0.6.5 11.05.2026 SB2026051154
#VU130242 - Authorization Bypass Through User-Controlled Key
CVE-2026-44570
CWE-639 Medium
No
No
0.6.19 06.05.2026 SB2026050630


Showing elements 61 - 80 out of 134