open-webui vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 202512
3. 2026158

Newest CVEs

• CVE-2026-109572

  Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy

  open-webui · open-webui

  High7.2
• CVE-2026-109300

  Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

  open-webui · open-webui

  Medium5.1
• CVE-2026-109299

  Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation

  open-webui · open-webui

  High7.1
• CVE-2026-109298

  Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex

  open-webui · open-webui

  High7.1
• CVE-2026-109297

  Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules

  open-webui · open-webui

  High7.1
• CVE-2026-109296

  Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes

  open-webui · open-webui

  Medium5.3
• CVE-2026-109295

  Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop

  open-webui · open-webui

  Medium5.3
• CVE-2026-109294

  Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

  open-webui · open-webui

  High7.1
• CVE-2026-109293

  Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint

  open-webui · open-webui

  High7.1
• CVE-2026-109292

  Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections

  open-webui · open-webui

  High7.6