Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
CVE-2026-44566
# **CONFIDENTIAL** # KL-CAN-2024-002 ## Vulnerability Details | # | Field | Value | |---|-------|-------| | 1 | **Dis
#severity:high
共收录 5513 条相关情报。
← 返回所有主题Open WebUI has Improper Authorization Control
CVE-2026-44567
# **CONFIDENTIAL** # Vulnerability Disclosure Analysis Documentation --- ## Vulnerability Details | # | Field | Valu
Open WebUI has stored XSS in Excel file preview
CVE-2026-44549
### Summary Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the
Snipe-IT has Privilege Escalation via API Permissions Assignment
CVE-2026-44832
### Impact An authenticated user with only `users.edit` permission can escalate their own privileges to `admin` by sendi
MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability...
CVE-2026-44400
MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile
SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the...
CVE-2026-7807
SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary
Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows...
CVE-2026-29202
Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution
A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing...
CVE-2026-29203
A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on
banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI
CVE-2026-44209
## Summary `banks /tmp/rce_banks_exec').read() }}") p.text() ``` ```bash ls -l /tmp/rce_banks_exec # -rw-rw-r-- 1 ak a
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
CVE-2026-44728
### Impact Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output
Phoenix: Long-poll NDJSON body splitting causes large memory allocation
CVE-2026-32689
### Summary An unauthenticated denial-of-service vulnerability in Phoenix's long-poll transport allows a remote client
Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
CVE-2026-44554
# Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite ## Affected Component Retrieval w
Open WebUI's responses passthrough endpoint lacks access control authorization
CVE-2026-44556
## Summary The /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests directly t
Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
CVE-2026-44555
# Base Model Routing Bypasses Access Control via Model Chaining ## Affected Component Model chaining via `base_model_i
Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
CVE-2026-44552
# Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning ## A
Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
CVE-2026-44553
# Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access ## Affected Component Socket
MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys
CVE-2026-44680
## Summary MikroORM's identifier-quoting helper (`Platform.quoteIdentifier` and the postgres/mssql overrides) and its J
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
CVE-2026-6322
### Impact `fast-uri` v3.1.1 and earlier decodes percent-encoded authority delimiters (`%40` as `@`, `%3A` as `:`) insi
Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
CVE-2026-44499
## Summary A composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated re
open-webui Vulnerable to Stored XSS via Model Description
CVE-2026-44721
> [!IMPORTANT] > Relationship to CVE-2024-7990 > CVE-2024-7990 (issued by huntr.dev, March 2025) describes a stored XS