Baja
CVE-2026-59715
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 161
Restablecer filtros
Alta
CVE-2026-59219
Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
Baja
CVE-2026-59213
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
Alta
CVE-2026-59214
Open WebUI: Stored web worker XSS via Pyodide
Media
CVE-2026-59218
Open WebUI: Account enumeration via observable login timing discrepancy
Media
CVE-2026-45339
Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
Alta
CVE-2026-26193
Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
Media
CVE-2025-46571
Open WebUI allows limited stored XSS vila uploaded html file
Alta
CVE-2025-46719
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
Media
CVE-2026-34225
Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality
Alta
CVE-2026-26192
Open WebUI vulnerable to Stored XSS via iFrame in citations model
Alta
CVE-2026-54008
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
Alta
CVE-2026-54010
Open WebUI: Forged chat-file link allows cross-user file read and deletion
Alta
CVE-2026-54012
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
Alta
CVE-2026-54011
Open WebUI: Stored XSS in Mermaid Markdown Preview
Alta
CVE-2026-54013
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
Alta
CVE-2026-54017
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
Media
CVE-2026-54019
Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Alta
CVE-2026-54018
Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
Media
CVE-2026-54016
Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration
Media
CVE-2026-54021
Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter
Media
CVE-2026-54022
Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
Media
CVE-2026-54014
Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}
Media
CVE-2026-54009
Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.