open-webui open-webui

Name: open-webui open-webui
Brand: open-webui

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

5critical6high23medium0low

updated 2026-10-28

vulnerabilities (128)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-64495US	medium5.4	0.49% (42nd)	Exploit	no fix	2025-11-08	≤ < 0.6.35
CVE-2026-70481US	—OT elevated	0.43% (37th)	Exploit	0.11.0	2026-08-04	0.5.0, → 0.11.0
CVE-2026-45401US	—	0.30% (23rd)	Exploit	no fix	2026-05-15	≤ < 0.9.5
CVE-2026-45316US	—OT elevated	0.24% (14th)	Exploit	no fix	2026-05-15	≤ < 0.9.3
CVE-2025-64496US	high8.0	7.23% (94th)	—	no fix	2025-11-08	≤ < 0.6.35
CVE-2026-34222US	high7.7	5.01% (92nd)	—	no fix	2026-04-01	≤ < 0.8.11
CVE-2025-65958US	high7.1	4.43% (91st)	—	no fix	2025-12-04	≤ < 0.6.37
CVE-2026-28788US	—	2.97% (87th)	—	no fix	2026-03-27	≤ < 0.8.6
CVE-2026-44551US	—	1.46% (73rd)	—	no fix	2026-05-15	≤ < 0.9.0
CVE-2026-45397US	—OT elevated	0.75% (55th)	—	no fix	2026-05-15	≤ < 0.9.5
CVE-2026-56398US	critical9.0	0.64% (50th)	—	0.9.5	2026-07-15	0 → 0.9.5
CVE-2026-70493US	—	0.59% (48th)	—	0.11.0	2026-08-04	0.9.6, → 0.11.0
CVE-2025-46719US	medium5.4	0.58% (47th)	—	no fix	2025-05-05	≤ < 0.6.6
CVE-2026-70489US	—	0.57% (47th)	—	0.11.0	2026-08-04	0.9.0, → 0.11.0
CVE-2026-59220US	—	0.57% (47th)	—	0.10.0	2026-07-09	0.9.2, → 0.10.0
CVE-2026-28786US	—	0.57% (47th)	—	no fix	2026-03-27	≤ < 0.8.6
CVE-2026-70482US	high8.8	0.57% (47th)	—	0.11.0	2026-08-04	0.8.0, → 0.11.0
CVE-2026-59219US	—	0.55% (46th)	—	0.10.0	2026-07-09	0.9.0, → 0.10.0
CVE-2026-70494US	—OT elevated	0.55% (46th)	—	0.11.0	2026-08-04	0.10.0, → 0.11.0
CVE-2026-59226US	medium4.3OT elevated	0.53% (44th)	—	0.10.0	2026-07-09	0.9.0, → 0.10.0
CVE-2026-54017US	—	0.52% (44th)	—	no fix	2026-06-18	≤ < 0.9.6
CVE-2026-56400US	critical9.6	0.52% (44th)	—	0.3.14	2026-07-15	0 → 0.3.14
CVE-2026-59221US	—	0.48% (41st)	—	0.10.0	2026-07-09	0.9.6, → 0.10.0
CVE-2026-59714US	—OT elevated	0.48% (41st)	—	0.10.0	2026-08-13	0.9.5, → 0.10.0
CVE-2026-70491US	—	0.48% (41st)	—	no fix	2026-08-04	≤ < 0.11.0
CVE-2026-70479US	—	0.47% (40th)	—	0.11.0	2026-08-04	0.9.6, → 0.11.0
CVE-2026-59222US	medium6.5	0.46% (40th)	—	0.10.0	2026-07-09	0.7.0, → 0.10.0
CVE-2026-70483US	medium4.3OT elevated	0.46% (40th)	—	0.11.0	2026-08-04	0.9.6, → 0.11.0
CVE-2026-59216US	critical9.0OT elevated	0.45% (39th)	—	no fix	2026-07-09	≤ < 0.10.0
CVE-2026-56399US	—	0.45% (39th)	—	0.6.27	2026-06-30	0 → 0.6.27
CVE-2026-44565US	—	0.45% (39th)	—	no fix	2026-05-15	≤ < 0.6.10
CVE-2026-45395US	—OT elevated	0.44% (38th)	—	no fix	2026-05-15	≤ < 0.9.5
CVE-2026-59214US	critical9.0	0.42% (36th)	—	no fix	2026-07-09	≤ < 0.10.0
CVE-2026-59227US	medium5.4OT elevated	0.42% (36th)	—	0.10.0	2026-07-09	0.8.11, → 0.10.0
CVE-2026-59212US	—OT elevated	0.42% (36th)	—	0.10.0	2026-07-09	0.9.6, → 0.10.0
CVE-2026-54010US	—OT elevated	0.42% (36th)	—	no fix	2026-06-23	≤ < 0.9.6
CVE-2026-70487US	medium6.5OT elevated	0.42% (36th)	—	0.11.0	2026-08-04	0.8.8, → 0.11.0
CVE-2026-70484US	medium5.4OT elevated	0.41% (35th)	—	0.11.0	2026-08-04	0.7.0, → 0.11.0
CVE-2026-59218US	—	0.41% (35th)	—	no fix	2026-07-09	≤ < 0.10.0
CVE-2024-30256US	—	0.41% (35th)	—	no fix	2024-04-16	2 versions
CVE-2026-45672US	—OT elevated	0.41% (35th)	—	no fix	2026-05-15	≤ < 0.8.12
CVE-2026-70492US	medium5.4	0.40% (34th)	—	0.11.0	2026-08-04	0.10.0, → 0.11.0
CVE-2026-45338US	—	0.40% (34th)	—	no fix	2026-05-15	≤ < 0.9.0
CVE-2026-59224US	—	0.39% (33rd)	—	no fix	2026-07-09	≤ < 0.10.0
CVE-2026-54019US	—OT elevated	0.39% (32nd)	—	no fix	2026-06-23	≤ < 0.9.6
CVE-2026-54018US	—	0.39% (32nd)	—	no fix	2026-06-23	≤ < 0.9.6
CVE-2026-59223US	—	0.38% (32nd)	—	no fix	2026-07-09	≤ < 0.10.0
CVE-2026-54009US	—	0.38% (32nd)	—	no fix	2026-06-23	≤ < 0.9.6
CVE-2026-70486US	medium5.4	0.38% (32nd)	—	0.11.0	2026-08-04	0.9.0, → 0.11.0
CVE-2026-59213US	medium5.0	0.37% (31st)	—	0.10.0	2026-07-09	0.6.27, → 0.10.0

showing 50 of 128

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-862Missing Authorization33 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')20 CVEs
CWE-863Incorrect Authorization20 CVEs
CWE-639Authorization Bypass Through User-Controlled Key18 CVEs
CWE-918Server-Side Request Forgery (SSRF)17 CVEs
CWE-284Improper Access Control7 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor6 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')6 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)128 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan