High
CVE-2026-87995
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 18
Reset filters
High
CVE-2026-70486
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
High
CVE-2026-70492
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Medium
CVE-2026-70480
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
High
CVE-2026-26193
Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
High
CVE-2025-46719
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
High
CVE-2026-26192
Open WebUI vulnerable to Stored XSS via iFrame in citations model
High
CVE-2026-54011
Open WebUI: Stored XSS in Mermaid Markdown Preview
High
CVE-2026-54007
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Medium
CVE-2026-54006
Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar
High
CVE-2026-45398
Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
High
CVE-2026-45315
Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
Medium
CVE-2026-45318
Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)
Medium
CVE-2026-45317
Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation
High
CVE-2026-44549
Open WebUI has stored XSS in Excel file preview
Medium
CVE-2026-44568
Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order
High
CVE-2026-44721
open-webui Vulnerable to Stored XSS via Model Description
High
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.