O
Vendor security profile
open-webui
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs72
Critical0
CISA KEV0
Public exploit36
Patch rate%65
Avg. CVSS6.3
12-month vulnerability rate
0
0
1
0
1
0
2
1
6
18
18
19
CVE KEV
CVE severity distribution
72toplam CVE
High30 (42%)
Medium33 (46%)
Low4 (6%)
Uncertain5 (7%)
Patch and exploitation view
%65
Verified patch
%0
CISA KEV
%50
Public exploit
47Patch available
0Partial
1Workaround
0Vendor: no patch
24Unknown
Latest vulnerabilities
7.2
CVE-2026-109572
Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy
O
Patch verifiedEPSS %0
5.1
CVE-2026-109300
Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds
O
Patch status unknownEPSS %0
7.1
CVE-2026-109299
Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation
O
Patch verifiedEPSS %0
7.1
CVE-2026-109298
Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex
O
Patch verifiedEPSS %0
7.1
CVE-2026-109297
Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules
O
Patch status unknownEPSS %0
5.3
CVE-2026-109296
Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes
O
Patch status unknownEPSS %0
7.1
CVE-2026-109295
Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop
O
Patch status unknownEPSS %0
7.1
CVE-2026-109294
Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image
O
Patch status unknownEPSS %0
7.1
CVE-2026-109293
Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint
O
Patch status unknownEPSS %0
7.6
CVE-2026-109292
Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections
O
Patch verifiedEPSS %0