Medium
CVE-2026-45351
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-45666
Open WebUI has an Indirect Object Reference (IDOR) in user notes
Medium
CVE-2026-45385
Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint
High
CVE-2026-45398
Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
High
CVE-2026-45314
Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
High
CVE-2026-45338
Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
High
CVE-2026-45348
pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal
High
CVE-2026-45331
Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature
High
CVE-2026-45315
Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
Low
CVE-2026-45316
Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)
Medium
CVE-2026-45318
Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)
High
CVE-2026-45349
Open WebUI has Broken Access Control for Completions API
Medium
CVE-2026-45345
Open WebUI missing authorization check at the model update function - models from other users can be updated
Medium
CVE-2026-45347
Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function
Medium
CVE-2026-45317
Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation
High
CVE-2026-45350
Open WebUI's chat completion API allows tool restrictions to be bypassed
Medium
CVE-2026-44919
OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices
High
CVE-2026-43977
wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API
High
CVE-2026-43978
wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
Medium
CVE-2026-44722
pyzipper has an encryption bypass for small files encrypted using it
Medium
CVE-2026-45306
pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
High
CVE-2026-45303
Open WebUI has stored XSS via the HTML renedering view
High
CVE-2026-45301
Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file
Medium
CVE-2026-45299
Open WebUI has Stored Cross-Site Scripting In Profile Picture
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.