Medium
CVE-2026-44337
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,015
Reset filters
High
CVE-2026-44569
Open WebUI's Insecure Message Access Breaks Authorization
High
CVE-2026-44570
Open WebUI has inconsistent authorization controls within memories API
High
CVE-2026-44565
Open WebUI Arbitrary File Write, Delete via Path Traversal
Medium
CVE-2026-44571
Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission
High
CVE-2026-44843
LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
Medium
CVE-2026-44844
eml_parser has recursion DoS via nested message/rfc822 attachments
Medium
CVE-2026-44564
Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO
High
CVE-2026-44549
Open WebUI has stored XSS in Excel file preview
Medium
CVE-2026-44559
Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels
High
CVE-2026-44566
Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
High
CVE-2026-44209
banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI
Medium
CVE-2026-44661
utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
High
CVE-2026-44555
Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
Medium
CVE-2026-44550
Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts
High
CVE-2026-44552
Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
High
CVE-2026-44641
Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install
High
CVE-2026-44334
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
Medium
CVE-2026-44363
misp-modules has nsafe remote resource fetching in expansion
Medium
CVE-2026-44520
docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler
High
CVE-2026-44504
Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)
High
CVE-2026-42557
JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content
High
CVE-2026-42561
python-multipart has Denial of Service via unbounded multipart part headers
Medium
CVE-2026-44305
Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.