Known vulnerabilities in Open WebUI - page 8

Vendor: Open WebUI
Software: Open WebUI
Software CPE: cpe:2.3:a:open_webui:ollama_webui:*:*:*:*:*:*:*:*
Total vulnerabilities: 161
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Open WebUI Open WebUI is affected by 161 known vulnerabilities: 6 high, 27 medium, 128 low Critical High Medium Low

Vulnerabilities (161)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU130178 - Missing Authorization
CVE-2026-44556
CWE-862 Low
No
No
0.9.0 05.05.2026 SB2026050527
#VU127479 - Server-Side Request Forgery (SSRF)
CVE-2026-34225
CWE-918 Low
No
No
0.8.0 24.04.2026 SB2026042443
#VU127478 - Improper Authorization
CVE-2026-34222
CWE-285 Low
No
No
0.8.11 24.04.2026 SB2026042442
#VU127477 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-28786
CWE-22 Low
No
No
0.8.6 24.04.2026 SB2026042441
#VU127476 - Authorization Bypass Through User-Controlled Key
CVE-2026-29071
CWE-639 Low
No
No
0.8.6 24.04.2026 SB2026042441
#VU127475 - Authorization Bypass Through User-Controlled Key
CVE-2026-28788
CWE-639 Low
No
No
0.8.6 24.04.2026 SB2026042441
#VU127474 - Improper Access Control
CVE-2026-29070
CWE-284 Low
No
No
0.8.6 24.04.2026 SB2026042441
#VU127473 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-26193
CWE-79 Low
No
No
0.7.0 24.04.2026 SB2026042440
#VU127472 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-26192
CWE-79 Low
No
No
0.7.0 24.04.2026 SB2026042440
#VU127471 - Server-Side Request Forgery (SSRF)
CVE-2025-65958
CWE-918 Medium
No
No
0.9.5 24.04.2026 SB2026042439
#VU127470 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-65959
CWE-79 Low
No
No
0.6.37 24.04.2026 SB2026042439
#VU127469 - Eval Injection
CVE-2025-64496
CWE-95 Low
No
No
0.6.35 24.04.2026 SB2026042438
#VU127468 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-64495
CWE-79 Low
No
No
0.6.35 24.04.2026 SB2026042438
#VU121166 - Cleartext Transmission of Sensitive Information
CVE-2026-0767
CWE-319 Low
No
No
- 12.01.2026 SB2026011239
#VU121165 - Command injection
CVE-2026-0766
CWE-77 Medium
No
No
- 12.01.2026 SB2026011239
#VU121160 - Command injection
CVE-2026-0765
CWE-77 Medium
No
No
- 12.01.2026 SB2026011239
#VU108683 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-46571
CWE-79 Low
Available
No
0.6.6 06.05.2025 SB2025050614
#VU108682 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-46719
CWE-79 Low
Available
No
0.6.6 06.05.2025 SB2025050614
#VU95620 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-6706
CWE-79 Low
No
No
- 09.08.2024 SB2024080929
#VU95618 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-6707
CWE-22 Medium
No
No
0.1.117 09.08.2024 SB2024080928


Showing elements 141 - 160 out of 161