agentprime: open-webuiEvery new CVE for open-webui.https://agentprime.io/CVE-2026-109572: Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxyhttps://agentprime.io/advisories/CVE-2026-109572/https://agentprime.io/advisories/CVE-2026-109572/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 22:21:48 GMTCVECVE-2026-109300: Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embedshttps://agentprime.io/advisories/CVE-2026-109300/https://agentprime.io/advisories/CVE-2026-109300/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:58 GMTCVECVE-2026-109299: Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validationhttps://agentprime.io/advisories/CVE-2026-109299/https://agentprime.io/advisories/CVE-2026-109299/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:57 GMTCVECVE-2026-109298: Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regexhttps://agentprime.io/advisories/CVE-2026-109298/https://agentprime.io/advisories/CVE-2026-109298/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:56 GMTCVECVE-2026-109297: Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Ruleshttps://agentprime.io/advisories/CVE-2026-109297/https://agentprime.io/advisories/CVE-2026-109297/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:56 GMTCVECVE-2026-109296: Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routeshttps://agentprime.io/advisories/CVE-2026-109296/https://agentprime.io/advisories/CVE-2026-109296/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:55 GMTCVECVE-2026-109295: Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loophttps://agentprime.io/advisories/CVE-2026-109295/https://agentprime.io/advisories/CVE-2026-109295/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:54 GMTCVECVE-2026-109294: Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Imagehttps://agentprime.io/advisories/CVE-2026-109294/https://agentprime.io/advisories/CVE-2026-109294/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:54 GMTCVECVE-2026-109293: Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpointhttps://agentprime.io/advisories/CVE-2026-109293/https://agentprime.io/advisories/CVE-2026-109293/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:53 GMTCVECVE-2026-109292: Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connectionshttps://agentprime.io/advisories/CVE-2026-109292/https://agentprime.io/advisories/CVE-2026-109292/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:52 GMTCVECVE-2026-109291: Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_urlhttps://agentprime.io/advisories/CVE-2026-109291/https://agentprime.io/advisories/CVE-2026-109291/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:52 GMTCVECVE-2026-109290: Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Previewhttps://agentprime.io/advisories/CVE-2026-109290/https://agentprime.io/advisories/CVE-2026-109290/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:51 GMTCVECVE-2026-109289: Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSockethttps://agentprime.io/advisories/CVE-2026-109289/https://agentprime.io/advisories/CVE-2026-109289/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:51 GMTCVECVE-2026-109288: Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Linkshttps://agentprime.io/advisories/CVE-2026-109288/https://agentprime.io/advisories/CVE-2026-109288/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:50 GMTCVECVE-2026-109287: Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory IDhttps://agentprime.io/advisories/CVE-2026-109287/https://agentprime.io/advisories/CVE-2026-109287/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:49 GMTCVECVE-2026-109286: Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModalhttps://agentprime.io/advisories/CVE-2026-109286/https://agentprime.io/advisories/CVE-2026-109286/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:48 GMTCVECVE-2026-109285: Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadatahttps://agentprime.io/advisories/CVE-2026-109285/https://agentprime.io/advisories/CVE-2026-109285/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:47 GMTCVECVE-2026-109284: Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpointhttps://agentprime.io/advisories/CVE-2026-109284/https://agentprime.io/advisories/CVE-2026-109284/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:46 GMTCVECVE-2026-109283: Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchangehttps://agentprime.io/advisories/CVE-2026-109283/https://agentprime.io/advisories/CVE-2026-109283/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:46 GMTCVECVE-2026-56399: Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/webhttps://agentprime.io/advisories/CVE-2026-56399/https://agentprime.io/advisories/CVE-2026-56399/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Jun 2026 22:08:40 GMTCVECVE-2024-6707: Open WebUI Arbitrary File Upload + Path Traversalhttps://agentprime.io/advisories/CVE-2024-6707/https://agentprime.io/advisories/CVE-2024-6707/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Aug 2024 23:04:45 GMTCVECVE-2024-30256: Open WebUI vulnerable to server-side request forgery in utils.pyhttps://agentprime.io/advisories/CVE-2024-30256/https://agentprime.io/advisories/CVE-2024-30256/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 16 Apr 2024 14:24:21 GMTCVE