AI Threat AlertOpen-Webui
AI Threat Alert tracks 51 known AI/ML vulnerabilities affecting Open-Webui products — each enriched with CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis. Browse every Open-Webui CVE below, sorted by severity and recency.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2026-109294 | Open WebUI: gzip bomb via image URL causes DoS | open-webui | 6.5 |
| HIGH | CVE-2026-109290 | Open WebUI: stored XSS via DOCX preview enables admin takeover | open-webui | 7.3 |
| MEDIUM | CVE-2026-109288 | Open WebUI: stored XSS via javascript: links steals JWTs | open-webui | 6.4 |
| HIGH | CVE-2026-109291 | Open WebUI: stored XSS via citation URL steals tokens | open-webui | 7.3 |
| MEDIUM | CVE-2026-109287 | Open WebUI: IDOR in KB listing leaks folder metadata | open-webui | 4.3 |
| MEDIUM | CVE-2026-109299 | Open WebUI: recurrence rule DoS stalls event loop | open-webui | 6.5 |
| MEDIUM | CVE-2026-109297 | Open WebUI: automation recurrence rules cause DoS | open-webui | 6.5 |
| MEDIUM | CVE-2026-109298 | Open WebUI: regex DoS via grep tools exhausts memory | open-webui | 6.5 |
| MEDIUM | CVE-2026-109300 | Open WebUI: stored XSS via tool-call embeds in Markdown | open-webui | 4.6 |
| MEDIUM | CVE-2026-109295 | Open WebUI: ReDoS via grep file tools stalls workers | open-webui | 6.5 |
| HIGH | CVE-2026-109572 | Open WebUI: terminal proxy privilege escalation | open-webui | 7.6 |
Page 3 of 3
Frequently asked questions
How many known vulnerabilities affect Open-Webui?
51 AI/ML CVEs affecting Open-Webui products are tracked, sourced from NVD and GitHub Advisory.
What Open-Webui products are affected?
The CVEs below map to the Open-Webui AI/ML packages and tools tracked by AI Threat Alert; open any CVE to see the affected components and versions.
Where does the Open-Webui vulnerability data come from?
Data is sourced from NVD and GitHub Advisory, then enriched with CVSS severity, EPSS exploit probability, and patch status for each CVE.
How can I monitor Open-Webui for new vulnerabilities?
AI Threat Alert tracks Open-Webui continuously; a Pro subscription adds breaking alerts when new CVEs affecting Open-Webui are published.
How do I assess Open-Webui's security exposure?
Each CVE below carries CVSS severity and exploitation signals, so you can review the highest-severity Open-Webui issues first and judge the exposure for your stack.