Live data from GitHub and PyPI, updated daily.
Data last fetched: 2026-10-22
10 active CVEs reported via OSV.dev
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
Open WebUI has unauthorized deletion of knowledge files
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
Open WebUI has an LDAP Empty Password Authentication Bypass
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
Other AI / ML projects in the Python ecosystem worth evaluating.
Get SLA-backed support, security patches, and direct access to senior engineers for Open WebUI — without relying on volunteer maintainers.