Openwebui Open Webui vulnerabilities
155 published vulnerabilities in Openwebui Open Webui. The most were published in 2026 (137), and 137 so far in 2026.
Openwebui Open Webui vulnerabilities by year
2024
2025
2026
Most exploited Openwebui Open Webui vulnerabilities
- CVE-2026-44551 Open WebUI: LDAP Empty Password Authentication Bypass
- CVE-2026-56400 open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
- CVE-2024-8017 Cross-site Scripting (XSS) in open-webui/open-webui
- CVE-2026-45672 Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
- CVE-2026-87995 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
- CVE-2026-70492 Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
- CVE-2026-54011 Open WebUI: Stored XSS in Mermaid Markdown Preview
- CVE-2026-44552 Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
- CVE-2026-45315 Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
- CVE-2025-65959 Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF'
- CVE-2025-64495 Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
- CVE-2026-56398 Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.