Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
174 results · page 4 of 4
Apr 13, 2026Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-34225 · Other software · open-webui · reported by GitHubMedium 4.3
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.7.2 and below contain a Blind Server Side Request Forgery in the functionality that allows editing an image via a prompt. The affected function performs a GET request to a user-provided URL with no restriction on the domain, allowing the local address space to be accessed. Since the SSRF is blind (the response cannot be read), the primary impact is port scanning of the local network, as whether a port is open can be determined based on whether the GET request succeeds or fails. These response differentials can be automated to iterate through the entire port range and identify open ports. If the service running on an open port can be inferred, an attacker may be able to interact with it in a meaningful way, provided the service offers state-changing GET request endpoints. This issue was unresolved at the time of publication.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-34222 · Other software · open-webui · reported by GitHubHigh 7.7
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-29071 · Other software · open-webui · reported by GitHubLow 3.1
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, any authenticated user can read other users' private memories via `/api/v1/retrieval/query/collection`. Version 0.8.6 patches the issue.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-29070 · Other software · open-webui · reported by GitHubMedium 5.4
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base (or is admin), but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from arbitrary knowledge bases (as long as one knows the file id). Version 0.8.6 patches the issue.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-28788 · Other software · open-webui · reported by GitHubHigh 7.1
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, any authenticated user can overwrite any file's content by ID through the `POST /api/v1/retrieval/process/files/batch` endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via `GET /api/v1/knowledge/{id}/files` and then overwrite those files, escalating from read to write. The overwritten content is served to the LLM via RAG, meaning the attacker controls what the model tells other users. Version 0.8.6 patches the issue.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-28786 · Other software · open-webui · reported by GitHubMedium 4.3
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an unsanitized filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a `FileNotFoundError` whose message — including the server's absolute `DATA_DIR` path — is returned verbatim in the HTTP 400 response body, confirming information disclosure on all default deployments. Version 0.8.6 patches the issue.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-26193 · Other software · open-webui · reported by GitHubHigh 7.3
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the `embeds` property on a response message, the content of which is loaded into an iFrame with a sandbox that has `allow-scripts` and `allow-same-origin` set, ignoring the "iframe Sandbox Allow Same Origin" configuration. This enables stored XSS on the affected chat. This also triggers when the chat is in the shared format. The result is a shareable link containing the payload that can be distributed to any other users on the instance. Version 0.6.44 fixes the issue.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-26192 · Other software · open-webui · reported by GitHubHigh 7.3
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponized document payload in a chat. The payload also executes when the citation is viewed on a shared chat. Version 0.7.0 fixes the issue.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2025-65959 · Other software · open-webui · reported by GitHubHigh 8.7
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. This vulnerability is fixed in 0.6.37.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2025-65958 · Other software · open-webui · reported by GitHubHigh 8.5
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025open-webui v0.6.33 is vulnerable to Incorrect Access Control.CVE-2025-63681 · Other software · Openwebui · reported by MITREMedium 4.3
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.
- Product
- Open Webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2025-64496 · Other software · open-webui · reported by GitHubHigh 7.3
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2025-64495 · Other software · open-webui · reported by GitHubHigh 8.7
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation. Any user with permissions to create prompts can abuse this to plant a payload that could be triggered by other users if they run the corresponding / command to insert the prompt. This issue is fixed in version 0.6.35.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2025-46719 · Other software · open-webui · reported by GitHubMedium 5.4
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, a vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaScript code into a chat transcript. The JavaScript code will be executed in the user's browser every time that chat transcript is opened, allowing attackers to retrieve the user's access token and gain full control over their account. Chat transcripts can be shared with other users in the same server, or with the whole open-webui community if "Enable Community Sharing" is enabled in the admin panel. If this exploit is used against an admin user, it is possible to achieve Remote Code Execution on the server where the open-webui backend is hosted. This can be done by creating a new function which contains malicious python code. This vulnerability also affects chat transcripts uploaded to `https://openwebui.com/c/<user>/<chat_id>`, allowing for wormable stored XSS in https[:]//openwebui[.]com. Version 0.6.6 contains a patch for the issue.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2025-46571 · Other software · open-webui · reported by GitHubMedium 5.3
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML files which contain JavaScript code via the `/api/v1/files/` backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files uploaded by low-privileged users can only be viewed by admins or themselves, limiting the impact of this vulnerability. A link to such a file can be sent to an admin, and if clicked, will give the low-privileged user complete control over the admin's account, ultimately enabling RCE via functions. Version 0.6.6 contains a fix for the issue.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PCVE-2024-8053 · Other software · open-webui · reported by security@huntr.devHigh 8.2
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.
- Product
- open-webui/open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips.CVE-2024-8017 · Other software · open-webui · reported by security@huntr.devCritical 9
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their own account to an admin if the victim is an admin.
- Product
- open-webui/open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication.CVE-2024-7983 · Other software · open-webui · reported by security@huntr.devHigh 7.5
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete.
- Product
- open-webui/open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8.CVE-2024-7044 · Other software · open-webui · reported by security@huntr.devHigh 8.9
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.
- Product
- open-webui/open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files.CVE-2024-7043 · Other software · open-webui · reported by security@huntr.devHigh 8.8
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all files uploaded by users, which includes the ID values. The attacker can then use the GET /api/v1/files/{file_id} interface to obtain information on any file and the DELETE /api/v1/files/{file_id} interface to delete any file.
- Product
- open-webui/open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method.CVE-2024-7035 · Other software · open-webui · reported by security@huntr.devMedium 6.9
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks, where an unaware user can unintentionally perform sensitive actions by simply visiting a malicious site or through top-level navigation. The affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. This impacts both the availability and integrity of the application.
- Product
- open-webui/open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc.CVE-2024-7048 · Other software · open-webui · reported by security@huntr.devMedium 5.4
In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this vulnerability, an attacker can view metadata of files uploaded by an admin and overwrite these files, compromising the integrity and availability of the RAG models.
- Product
- open-webui/open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8.CVE-2024-7041 · Other software · open-webui · reported by security@huntr.devMedium 6.5
An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.
- Product
- open-webui/open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024Open WebUI is a user-friendly WebUI for LLMs.CVE-2024-30256 · Other software · open-webui · reported by GitHubMedium 6.4
Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.117.
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.