Medium
CVE-2026-44562
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,406
Medium
CVE-2026-44563
Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show
High
CVE-2026-44549
Open WebUI has stored XSS in Excel file preview
Medium
CVE-2026-44561
Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels
Medium
CVE-2026-44560
Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search
Medium
CVE-2026-44568
Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order
Medium
CVE-2026-44559
Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels
High
CVE-2026-44566
Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
Medium
CVE-2026-44558
Open WebUI's Channel Access Grants Bypass filter_allowed_access_grants
High
CVE-2026-44554
Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
Medium
CVE-2026-44557
Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection
High
CVE-2026-44209
banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI
Medium
CVE-2026-44661
utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
High
CVE-2026-40213
OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints
Medium
CVE-2026-40214
OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
High
CVE-2026-44555
Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
Medium
CVE-2026-44550
Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts
High
CVE-2026-44556
Open WebUI's responses passthrough endpoint lacks access control authorization
High
CVE-2026-44553
Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
High
CVE-2026-44552
Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
Medium
CVE-2026-44502
Bunsink has an SSRF bypass in `validate_webhook_url`
High
CVE-2026-44641
Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install
Medium
CVE-2026-44368
pyquorum: Timing side‑channel in mul_mod
High
CVE-2026-44335
PraisonAI has an SSRF bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.