CVE Tools
Track your stack

Open-webui

175 CVEs tracked since 2024. Since Oct 2024, none of them reached CISA KEV.

Open-webui CVEs per month

Oct 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Open-webui CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2024-1050
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-03200
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-05590
2026-06170
2026-07190
2026-08180
2026-09180
2026-10190
2026-110

Products

The products that kept showing up in Open-webui's monthly top three, with their CVEs summed over those months.

  1. Open-webui1506 months
  2. Open-webui/open-webui252 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Open-webui.

  1. CVE-2026-109572Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy7.6
  2. CVE-2026-109300Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds4.6
  3. CVE-2026-109299Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation6.5
  4. CVE-2026-109297Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules6.5
  5. CVE-2026-109298Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex6.5
  6. CVE-2026-109296Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes4.3
  7. CVE-2026-109295Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop4.3
  8. CVE-2026-109294Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image6.5
  9. CVE-2026-109293Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint6.5
  10. CVE-2026-109292Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections6.8
  11. CVE-2026-109291Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url7.3
  12. CVE-2026-109290Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview8.7
  13. CVE-2026-109289Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket6.3
  14. CVE-2026-109288Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links6.4
  15. CVE-2026-109287Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID4.3

The record

Peak rank
#13 in May 2026
Busiest month shown
May 2026, 59 CVEs
Months with a KEV entry
0 since Oct 2024
Monthly snapshots
8 since 2024
Open-webui's full record, month by month