High
CVE-2026-44549
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,334
Reset filters
Medium
CVE-2026-44561
Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels
Medium
CVE-2026-44560
Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search
Medium
CVE-2026-44559
Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels
High
CVE-2026-44566
Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
High
CVE-2026-44554
Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
Medium
CVE-2026-44557
Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection
Medium
CVE-2026-44661
utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
Medium
CVE-2026-40214
OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
High
CVE-2026-44555
Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
Medium
CVE-2026-44550
Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts
Medium
CVE-2026-44502
Bunsink has an SSRF bypass in `validate_webhook_url`
High
CVE-2026-44641
Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install
High
CVE-2026-44334
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
Medium
CVE-2026-44520
docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler
Medium
CVE-2026-40610
BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context
High
CVE-2026-42557
JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content
High
CVE-2026-42561
python-multipart has Denial of Service via unbounded multipart part headers
High
CVE-2026-44307
Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup
Low
CVE-2026-42448
Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed
High
CVE-2026-42544
Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic
Medium
CVE-2026-42545
Granian vulnerable to DoS via WSGI response header panic
Medium
CVE-2026-44226
PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI
Medium
CVE-2026-44222
vLLM Vulnerable to Remote DoS via Special-Token Placeholders
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.