Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Open-webui CVE-2026-109300
Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109299
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Open-webui CVE-2026-109298
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109297
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses r
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109296
Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying a
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109295
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via f
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109294
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by sup
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109293
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to o
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109292
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receivin
3 CVEs and 3 credit lines. None claimed yet.
0 of 3 credit lines claimed Claim credit -
Open-webui CVE-2026-109291
Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by sto
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109290
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute scrip
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109289
Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through a
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109288
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109287
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109286
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109285
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep f
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109284
Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's f
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Open-webui CVE-2026-109283
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's use
3 CVEs and 3 credit lines. None claimed yet.
0 of 3 credit lines claimed Claim credit
-
Open-webui open-webui-2026-10
Open-webui Security Releases - October 2026
42 CVEs and 42 credit lines. None claimed yet.
0 of 42 credit lines claimed Claim credit