Advisories

Security advisories for popular AI software, newest first, each linked to its public source.

All Critical High Medium Low Info

727 advisories

2026-10-27 // 17:46 UTC High SA-26-077

Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false`, feature gate bypassed

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-076

Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach…

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-075

Open WebUI: Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints…

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-074

Open WebUI: Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-073

Open WebUI: Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-072

Open WebUI: Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-071

Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation…

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-070

Open WebUI: Prior to 0.9.5, the tool update endpoint (POST /api/v1/tools/id/{id}/update) is missing the…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-069

Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-068

Open WebUI: Open WebUI has an IDOR vulnerability in the pin_channel_message API endpoint

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-067

Open WebUI: Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-066

Open WebUI: open-webui Vulnerable to Stored XSS via Model Description

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-065

Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-064

Open WebUI: Shared-chat branch ignores access_type, allowing unauthorized file deletion

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-063

Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing…

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-062

Open WebUI: Open WebUI has Broken Access Control for Completions API

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-061

Open WebUI: Prior to 0.9.0, Open WebUI allows admins to restrict which API endpoints an API key can access

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-060

Open WebUI: Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-059

Open WebUI: Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-058

Open WebUI: Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-057

Open WebUI: Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-056

Open WebUI: Open WebUI's Model Import Overwrites Any Model Without Ownership Check

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-055

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-054

Open WebUI: Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-053

Open WebUI: Open WebUI Missing Access Check on Channel Members Endpoint for Standard Channels

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-052

Open WebUI: Open WebUI's Channel Access Grants Bypass filter_allowed_access_grants

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-051

Open WebUI: Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-050

Open WebUI: Open WebUI's responses passthrough endpoint lacks access control authorization

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-049

Open WebUI: Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-048

Open WebUI: Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection…

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-047

Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-046

Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance…

Affects: Open WebUI

2026-10-27 // 17:46 UTC Critical SA-26-045

Open WebUI: Open WebUI has an LDAP Empty Password Authentication Bypass

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-044

Open WebUI: Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users'…

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-043

MLflow: Unauthenticated access to certain FastAPI routes

Affects: MLflow

2026-10-27 // 17:46 UTC High SA-26-042

Open WebUI: Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in…

Affects: Open WebUI

2026-10-27 // 17:46 UTC High SA-26-041

Flowise: Flowise has an MCP Security Bypass that Enables RCE

Affects: Flowise

2026-10-27 // 17:46 UTC Critical SA-26-040

Jupyter: JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted…

Affects: Jupyter

2026-10-27 // 17:46 UTC High SA-26-039

Jupyter: JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious)…

Affects: Jupyter

2026-10-27 // 17:46 UTC High SA-26-038

LangChain: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary…

Affects: LangChain

2026-10-27 // 17:46 UTC Medium SA-26-037

vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

Affects: vLLM

2026-10-27 // 17:46 UTC High SA-26-036

vLLM: vLLM Vulnerable to Remote DoS via Special-Token Placeholders

Affects: vLLM

2026-10-27 // 17:46 UTC Critical SA-26-035

Langflow: Langflow Knowledge Bases API is Vulnerable to Path Traversal

Affects: Langflow

2026-10-27 // 17:46 UTC High SA-26-034

MLflow: MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's…

Affects: MLflow

2026-10-27 // 17:46 UTC Critical SA-26-033

Flowise: Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients…

Affects: Flowise

2026-10-27 // 17:46 UTC High SA-26-032

MLflow: MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability

Affects: MLflow

2026-10-27 // 17:46 UTC High SA-26-031

LiteLLM: LiteLLM has a sandbox escape in custom-code guardrail

Affects: LiteLLM

2026-10-27 // 17:46 UTC High SA-26-030

Open WebUI: Open WebUI has a CORS misconfiguration and session validation issue

Affects: Open WebUI

2026-10-27 // 17:46 UTC Medium SA-26-029

AnythingLLM: Prior to version 1.12.1, GET /api/workspace/:slug/tts/:chatId in AnythingLLM returns the…

Affects: AnythingLLM

2026-10-27 // 17:46 UTC High SA-26-028

Ray: From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types…

Affects: Ray