Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules
CVE-2026-109297
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator,
#advisory
共收录 23036 条相关情报。
← 返回所有主题Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes
CVE-2026-109296
Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disable
Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop
CVE-2026-109295
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authentic
Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image
CVE-2026-109294
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticat
Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint
CVE-2026-109293
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admi
Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections
CVE-2026-109292
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to
Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url
CVE-2026-109291
Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to ex
Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview
CVE-2026-109290
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that all
Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket
CVE-2026-109289
Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to ke
Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links
CVE-2026-109288
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which rend
Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID
CVE-2026-109287
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify
Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal
CVE-2026-109286
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows
Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata
CVE-2026-109285
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets fo
Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint
CVE-2026-109284
Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which pl
Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange
CVE-2026-109283
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders
CVE-2026-109282
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders,
ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option
CVE-2026-109281
ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain
ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option
CVE-2026-109280
ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access
CVE-2026-109279
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed,
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation
CVE-2026-109278
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fail