Medium
CVE-2026-44558
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 161
Reset filters
High
CVE-2026-44554
Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
Medium
CVE-2026-44557
Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection
High
CVE-2026-44555
Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
Medium
CVE-2026-44550
Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts
High
CVE-2026-44556
Open WebUI's responses passthrough endpoint lacks access control authorization
High
CVE-2026-44553
Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
High
CVE-2026-44552
Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
High
CVE-2026-34222
Open WebUI has Broken Access Control in Tool Valves
Low
CVE-2026-29071
Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories
Medium
CVE-2026-29070
Open WebUI has unauthorized deletion of knowledge files
Medium
CVE-2026-28786
Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`
High
CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
High
CVE-2025-65958
Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web
High
CVE-2024-7990
Open WebUI stored cross-site scripting (XSS) vulnerability
High
CVE-2024-8060
Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions
Medium
CVE-2024-7045
Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read
Medium
CVE-2024-7046
Open WebUI Allows Viewing of Admin Details
High
CVE-2024-7806
Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability
High
CVE-2024-7053
Open WebUI Vulnerable to a Session Fixation Attack
High
CVE-2024-7036
Open WebUI Uncontrolled Resource Consumption vulnerability
Medium
CVE-2024-7037
open-webui allows writing and deleting arbitrary files
High
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
High
CVE-2026-56400
Open WebUI has a CORS misconfiguration and session validation issue
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.