npm/open-webui

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability

Modified: 4/15/2025

Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'

Modified: 12/5/2025

Open WebUI Uncontrolled Resource Consumption vulnerability

Modified: 7/7/2026

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

Modified: 7/7/2026

Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order

Modified: 5/19/2026

Open WebUI Uncontrolled Resource Consumption vulnerability

Modified: 7/7/2026

open-webui Vulnerable to Stored XSS via Model Description

Modified: 7/13/2026

Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution

Modified: 5/16/2026

Open WebUI Has Stored Cross-Site Scripting in SVG Renderer

Modified: 5/19/2026

Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

Modified: 7/7/2026