Medium
CVE-2026-16974
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Critical
CVE-2026-28672
Apache Ranger has a Command Injection vulnerability
Medium
CVE-2026-18654
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
Medium
CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large CID font width ranges
Medium
CVE-2026-71870
pypdf: Possible large memory usage for large /ToUnicode streams
High
CVE-2026-67422
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Medium
CVE-2026-71554
h2: Duplicate Host header could facilitate request smuggling
High
CVE-2026-70486
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
Medium
CVE-2026-70491
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Medium
CVE-2026-70493
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
High
CVE-2026-70494
Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
High
CVE-2026-70492
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Medium
CVE-2026-70488
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
High
CVE-2026-70485
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Medium
CVE-2026-54020
Open WebUI: DNS Rebinding SSRF Bypass
Medium
CVE-2026-70484
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
Medium
CVE-2026-70489
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
Medium
CVE-2026-70487
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
Medium
CVE-2026-70490
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Low
CVE-2026-70483
Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
Medium
CVE-2026-12480
Keras: HDF5 virtual datasets can disclose local files
High
CVE-2026-12484
Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
Medium
CVE-2026-9335
Keras: HDF5 links can disclose local file contents
High
CVE-2026-70479
Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.