Login Request a demo
OW
Product
Open Webui
by Openwebui · last CVE Sep 10, 2026
155
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities155In the news0Timeline
Severity mix
Critical 7High 57Medium 89Low 2
Severity
All severities155Critical7High57Medium89Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Open Webui to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-44566
9.8
0%
May 15
Open WebUI: Arbitrary File Upload and Path Traversal
Affected: before 0.1.124
CVE-2026-56400
9.6
1%
Jul 15
open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
Affected: before 0.3.14
CVE-2026-44551
9.1
1%
May 15
Open WebUI: LDAP Empty Password Authentication Bypass
Affected: before 0.9.0
CVE-2026-56398
9.0
1%
Jul 15
Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI
Affected: before 0.9.5
CVE-2026-59216
9.0
0%
Jul 9
Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
Affected: before 0.10.0
CVE-2026-59214
9.0
0%
Jul 9
Open WebUI: Stored web worker XSS via Pyodide
Affected: before 0.10.0
CVE-2024-8017
9.0
1%
Mar 20
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips
Affected: through 0.3.8
Showing 7