Login Request a demo
OP
Product
open-webui
by open-webui · last CVE Oct 12, 2026
162
CVEs
0
On KEV
9.8
Max CVSS
19
New 30D
Vulnerabilities162In the news0Timeline
Severity mix
Critical 6High 57Medium 97Low 2
Severity
All severities162Critical6High57Medium97Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add open-webui to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-44566
9.8
0%
May 15
Open WebUI: Arbitrary File Upload and Path Traversal
Affected: < 0.1.124
CVE-2026-56400
9.6
1%
Jul 15
open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
Affected: before 0.3.14
CVE-2026-44551
9.1
1%
May 15
Open WebUI: LDAP Empty Password Authentication Bypass
Affected: < 0.9.0
CVE-2026-56398
9.0
1%
Jul 15
Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI
Affected: before 0.9.5
CVE-2026-59216
9.0
0%
Jul 9
Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
Affected: < 0.10.0
CVE-2026-59214
9.0
0%
Jul 9
Open WebUI: Stored web worker XSS via Pyodide
Affected: < 0.10.0
Showing 6