High
CVE-2026-45539
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,003
Reset filters
Medium
CVE-2026-45365
Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]
High
CVE-2026-45401
Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
Medium
CVE-2026-45396
Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation
Medium
CVE-2026-45667
Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)
High
CVE-2026-45400
Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
High
CVE-2026-45399
Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
Medium
CVE-2026-45666
Open WebUI has an Indirect Object Reference (IDOR) in user notes
High
CVE-2026-45398
Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
High
CVE-2026-45314
Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
High
CVE-2026-45338
Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
High
CVE-2026-45331
Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature
High
CVE-2026-45315
Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
Medium
CVE-2026-45318
Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)
High
CVE-2026-45349
Open WebUI has Broken Access Control for Completions API
Medium
CVE-2026-45347
Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function
Medium
CVE-2026-45317
Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation
High
CVE-2026-45350
Open WebUI's chat completion API allows tool restrictions to be bypassed
Medium
CVE-2026-45306
pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
Medium
CVE-2026-45299
Open WebUI has Stored Cross-Site Scripting In Profile Picture
High
CVE-2026-44541
ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override
Medium
CVE-2026-44968
dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
Low
CVE-2026-44970
dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction
Low
CVE-2026-44969
dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.