Known vulnerabilities in Open WebUI - page 6

Vendor: Open WebUI
Software: Open WebUI
Software CPE: cpe:2.3:a:open_webui:ollama_webui:*:*:*:*:*:*:*:*
Total vulnerabilities: 161
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Open WebUI Open WebUI is affected by 161 known vulnerabilities: 6 high, 27 medium, 128 low Critical High Medium Low

Vulnerabilities (161)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU131122 - Authorization Bypass Through User-Controlled Key
CVE-2026-45671
CWE-639 Medium
No
No
0.9.0 12.05.2026 SB2026050628
#VU131120 - Incorrect Authorization
CVE-2026-45672
CWE-863 Medium
No
No
0.8.12 12.05.2026 SB2026050628
#VU131118 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2026-45675
CWE-362 High
No
No
0.9.0 12.05.2026 SB2026050628
#VU131117 - Authorization Bypass Through User-Controlled Key
CVE-2026-45666
CWE-639 Low
No
No
0.8.11 12.05.2026 SB2026050628
#VU131115 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45665
CWE-79 Low
No
No
0.8.0 12.05.2026 SB2026050628
#VU131113 - Missing Authorization
CVE-2026-45667
CWE-862 Medium
No
No
0.8.0 12.05.2026 SB2026050628
#VU130938 - Cross-Site Request Forgery (CSRF)
CVE-2026-45317
CWE-352 Low
No
No
0.9.3 11.05.2026 SB2026051156
#VU130937 - Improper Neutralization of Alternate XSS Syntax
CVE-2026-45314
CWE-87 Low
No
No
0.9.3 11.05.2026 SB2026051156
#VU130936 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45318
CWE-79 Low
No
No
0.9.3 11.05.2026 SB2026051156
#VU130935 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45315
CWE-79 Low
No
No
0.9.3 11.05.2026 SB2026051156
#VU130931 - Improper Access Control
CVE-2026-45301
CWE-284 Medium
No
No
0.3.16 11.05.2026 SB2026051155
#VU130930 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45303
CWE-79 Low
No
No
0.6.5 11.05.2026 SB2026051154
#VU130928 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45299
CWE-79 Low
No
No
0.8.0 11.05.2026 SB2026050628
#VU130929 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
0.8.0 11.05.2026 SB2026050628
#VU130243 - Missing Authorization
CVE-2026-44569
CWE-862 Low
No
No
0.6.19 06.05.2026 SB2026050630
#VU130242 - Authorization Bypass Through User-Controlled Key
CVE-2026-44570
CWE-639 Medium
No
No
0.6.19 06.05.2026 SB2026050630
#VU130241 - Missing Authorization
CVE-2026-44571
CWE-862 Low
No
No
0.8.6 06.05.2026 SB2026050629
#VU130240 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-44549
CWE-79 Low
No
No
0.8.0 06.05.2026 SB2026050628
#VU130239 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-44568
CWE-79 Low
No
No
0.9.0 06.05.2026 SB2026050627
#VU130237 - Improper Authorization
CVE-2026-44567
CWE-285 Medium
No
No
0.1.124 06.05.2026 SB2026050626


Showing elements 101 - 120 out of 161