Vulnerabilidades en open-webui
173 resultadosCVE-2024-7035MEDIUMCross-Site Request Forgery (CSRF) in open-webui/open-webuiEPSS 8.7%CVE-2025-64496HIGHOpen WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE EventsEPSS 7.2%CVE-2026-34222HIGHOpen WebUI has Broken Access Control in Tool ValvesEPSS 5.1%CVE-2025-65958HIGHOpen WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/webEPSS 4.7%CVE-2026-28788HIGHOpen WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwriteEPSS 3.0%CVE-2026-44551CRITICALOpen WebUI: LDAP Empty Password Authentication BypassEPSS 1.5%CVE-2024-7983HIGHDenial of Service in open-webui/open-webuiEPSS 0.9%CVE-2026-45397MEDIUMOpen WebUI: Unauthenticated RAG Configuration DisclosureEPSS 0.8%CVE-2024-8053HIGHImproper Authentication in open-webui/open-webuiEPSS 0.7%CVE-2026-87011HIGHOpen WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutEPSS 0.6%CVE-2026-56398HIGHOpen WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URIEPSS 0.6%CVE-2024-8017CRITICALCross-site Scripting (XSS) in open-webui/open-webuiEPSS 0.6%CVE-2024-7043HIGHImproper Access Control in open-webui/open-webuiEPSS 0.6%CVE-2026-87016HIGHOpen WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteEPSS 0.6%CVE-2026-88000MEDIUMOpen WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat treeEPSS 0.6%CVE-2026-70493MEDIUMOpen WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophicallyEPSS 0.6%CVE-2025-46719MEDIUMOpen WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functionsEPSS 0.6%CVE-2026-88002MEDIUMOpen WebUI: Any authenticated user can hang the server via a cyclic chat message historyEPSS 0.6%CVE-2026-70489MEDIUMOpen WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsingEPSS 0.6%CVE-2026-59220MEDIUMOpen WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default configEPSS 0.6%