Recent Advisories

Severity ID Title Vendor Product Date Type
HIGH 7.5 CVE-2025-61020

CVE-2025-61020_CVE-2025-61020

An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafte...

n/a n/a n/a CVE
HIGH 7.5 CVE-2025-61018

CVE-2025-61018_CVE-2025-61018

An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted...

n/a n/a n/a CVE
HIGH 7.7 CVE-2026-54018

Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects_CVE-2026-54018

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader impl...

open-webui open-webui < 0.9.6 CVE
HIGH 7.6 CVE-2026-54013

Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI_CVE-2026-54013

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in us...

open-webui open-webui < 0.9.6 CVE
HIGH 7.1 CVE-2026-54012

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion_CVE-2026-54012

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can c...

open-webui open-webui < 0.9.6 CVE
HIGH 8.7 CVE-2026-54011

Open WebUI: Stored XSS in Mermaid Markdown Preview_CVE-2026-54011

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6,Open WebUI renders Mermaid blocks...

open-webui open-webui < 0.9.6 CVE
HIGH 8.3 CVE-2026-54010

Open WebUI: Forged chat-file link allows cross-user file read and deletion_CVE-2026-54010

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated...

open-webui open-webui < 0.9.6 CVE
HIGH 8.5 CVE-2026-54008

Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`_CVE-2026-54008

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backend/open_webui/utils/oauth.p...

open-webui open-webui < 0.9.6 CVE
HIGH 7.1 CVE-2026-54007

Open WebUI: Cross-origin postMessage confirmation bypass via action:submit_CVE-2026-54007

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows...

open-webui open-webui < 0.9.6 CVE
HIGH 7.4 CVE-2026-49440

Deno: Miller-Rabin Primality Test Allows Zero Rounds_CVE-2026-49440

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and crypto.chec...

denoland deno < 2.8.1 CVE