CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,231 CVEs published, 236 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,231
Show in the list
Critical, last 7 days
236
Show in the list
Healthcare-tagged, last 7 days
8
Show in the list
Known exploited (CISA KEV)
1,760
Show in the list

Showing CVEs that name the product openwebui:open_webui. Show all products

142 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-88006Medium 6.5Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88005Medium 6.5Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
Assigned by GitHub_M
Sep 10, 2026
CVE-2026-88002Medium 6.5Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
Assigned by GitHub_M
Sep 9, 2026
CVE-2026-88001Medium 5.0Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
Assigned by GitHub_M
Sep 9, 2026
CVE-2026-88000Medium 6.5Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
Assigned by GitHub_M
Sep 9, 2026
CVE-2026-87999High 7.1Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Assigned by GitHub_M
Sep 9, 2026
CVE-2026-87998High 7.1Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
Assigned by GitHub_M
Sep 9, 2026
CVE-2026-87997Medium 4.3Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
Assigned by GitHub_M
Sep 9, 2026
CVE-2026-87996High 7.7Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Assigned by GitHub_M
Sep 9, 2026
CVE-2026-87995High 8.7Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
Assigned by GitHub_M
Sep 9, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.