2026-05-16 归档

今日共收录 1030 条安全情报，包含 296 个 CVE，439 篇安全通告，以及 15 篇研究论文。

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, authorization controls surrounding the memories API were inco...

CVE-2026-44570

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, there's an IDOR in the channels message management system tha...

CVE-2026-44569

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, ther

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the API does not properly validate that the user has an auth...

CVE-2026-44567

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-602 #cwe-863

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, when attaching files to a promp, the name of the file is der...

CVE-2026-44566

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, whe

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-434

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.10, when uploading an audio file, the name of the file is derived...

CVE-2026-44565

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.10, when

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, Excel file attachments are previewed in an unsafe way. A craft...

CVE-2026-44549

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, Excel

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-15 发布INFO

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that allows remote attackers to cause a denial of service or po...

CVE-2026-8696

radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.12, the /api/v1/utils/code/execute endpoint executes arbitrary Py...

CVE-2026-45672

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.12, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the validate_url() function in backend/open_webui/retrieval/we...

CVE-2026-45401

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the v

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, a parsing difference between the urlparse and requests librari...

CVE-2026-45400

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, a par

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the POST /api/v1/evaluations/feedback endpoint in Open WebUI v...

CVE-2026-45396

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the P

历史摘要 · 未重新核验 · NVD

#cve #cwe-915

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the tool update endpoint (POST /api/v1/tools/id/{id}/update) i...

CVE-2026-45395

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the t

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-862

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, when setting model permissions so that a group has read access...

CVE-2026-45387

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, when

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, Pin/Unpin is a write operation (modifies the message's is_pinn...

CVE-2026-45386

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, Pin/U

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, an IDOR vulnerability exists in the Channels feature of Open W...

CVE-2026-45385

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, an ID

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a stored cross-site scripting (XSS) vulnerability that allows ...

CVE-2026-44721

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a sto

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, he LDAP and OAuth authentication flows use a TOCTOU (Time-of-C...

CVE-2026-45675

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, he LD

历史摘要 · 未重新核验 · NVD

#cve #cwe-269 #cwe-362

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user with low privileges can enumerate activ...

CVE-2026-45399

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a user just needs to use the API endpoint: /api/chat/completio...

CVE-2026-45349

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a use

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI allows admins to restrict which API endpoints an AP...

CVE-2026-45339

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open

历史摘要 · 未重新核验 · NVD

#cve #cwe-863