Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
22874
Total
1630
Critical
7150
High
7293
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-15202 | MEDIUM | 4.3 | A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function get_url of the file /yzmphp/yzmphp.php of the component Header Handler. … | Jul 09, 2026 |
| CVE-2026-15195 | MEDIUM | 6.3 | A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead … | Jul 09, 2026 |
| CVE-2026-14278 | UNKNOWN | — | Rejected reason: After further coordination, CVE was determined to not be warranted. | Jul 09, 2026 |
| CVE-2026-59715 | LOW | 3.1 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The ydoc:awareness:update and … | Jul 09, 2026 |
| CVE-2026-59227 | MEDIUM | 4.3 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /api/v1/images/edit required only a verified account and did not … | Jul 09, 2026 |
| CVE-2026-59226 | LOW | 3.1 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners without rechecking that they were still … | Jul 09, 2026 |
| CVE-2026-59225 | MEDIUM | 5.4 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena … | Jul 09, 2026 |
| CVE-2026-59224 | HIGH | 8.0 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and … | Jul 09, 2026 |
| CVE-2026-59223 | MEDIUM | 4.3 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_LIST matching compared configured host entries against URL strings and non-label-boundary … | Jul 09, 2026 |
| CVE-2026-59222 | UNKNOWN | — | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 before 0.10.0, GET /api/v1/channels//members returned full UserModelResponse objects for channel members, including … | Jul 09, 2026 |
| CVE-2026-59220 | MEDIUM | 6.5 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.2 before 0.10.0, the SKILL_MENTION_RE and strip_re regular expressions in backend/open_webui/utils/middleware.py parsed <$skillId|label> … | Jul 09, 2026 |
| CVE-2026-59219 | HIGH | 7.1 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the … | Jul 09, 2026 |
| CVE-2026-59218 | MEDIUM | 5.3 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the /api/v1/auths/signin endpoint looked users up by email and only ran … | Jul 09, 2026 |
| CVE-2026-59217 | MEDIUM | 4.3 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload path accepted metadata.knowledge_id and auto-linked uploaded files to … | Jul 09, 2026 |
| CVE-2026-59216 | HIGH | 7.7 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events to a client-supplied session_id … | Jul 09, 2026 |
| CVE-2026-59215 | LOW | 3.1 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread parent and reply handling did not bind parent_id to … | Jul 09, 2026 |
| CVE-2026-59214 | HIGH | 7.3 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web … | Jul 09, 2026 |
| CVE-2026-59213 | LOW | 3.5 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to … | Jul 09, 2026 |
| CVE-2026-59212 | MEDIUM | 5.4 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_knowledge_file_access only checked read access while file write and delete … | Jul 09, 2026 |
| CVE-2026-59209 | UNKNOWN | — | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow … | Jul 09, 2026 |
| CVE-2026-58459 | HIGH | 7.8 | gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to … | Jul 09, 2026 |
| CVE-2026-53987 | MEDIUM | 6.4 | The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() … | Jul 09, 2026 |
| CVE-2026-51606 | HIGH | 7.5 | An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with … | Jul 09, 2026 |
| CVE-2026-51605 | HIGH | 7.5 | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of … | Jul 09, 2026 |
| CVE-2026-51604 | HIGH | 7.5 | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of … | Jul 09, 2026 |