Media
CVE-2026-44558
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 161
Restablecer filtros
Alta
CVE-2026-44554
Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
Media
CVE-2026-44557
Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection
Alta
CVE-2026-44555
Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
Media
CVE-2026-44550
Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts
Alta
CVE-2026-44556
Open WebUI's responses passthrough endpoint lacks access control authorization
Alta
CVE-2026-44553
Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
Alta
CVE-2026-44552
Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
Alta
CVE-2026-34222
Open WebUI has Broken Access Control in Tool Valves
Baja
CVE-2026-29071
Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories
Media
CVE-2026-29070
Open WebUI has unauthorized deletion of knowledge files
Media
CVE-2026-28786
Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`
Alta
CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
Alta
CVE-2025-65958
Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web
Alta
CVE-2024-7990
Open WebUI stored cross-site scripting (XSS) vulnerability
Alta
CVE-2024-8060
Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions
Media
CVE-2024-7045
Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read
Media
CVE-2024-7046
Open WebUI Allows Viewing of Admin Details
Alta
CVE-2024-7806
Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability
Alta
CVE-2024-7053
Open WebUI Vulnerable to a Session Fixation Attack
Alta
CVE-2024-7036
Open WebUI Uncontrolled Resource Consumption vulnerability
Media
CVE-2024-7037
open-webui allows writing and deleting arbitrary files
Alta
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
Alta
CVE-2026-56400
Open WebUI has a CORS misconfiguration and session validation issue
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.