Open WebUI: Stored XSS in Mermaid Markdown Preview
Affects: Open WebUI
Advisories
Security advisories for popular AI software, newest first, each linked to its public source.
282 advisories rated Medium
Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
Affects: Open WebUI
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Affects: Open WebUI
Open WebUI: Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar
Affects: Open WebUI
Langflow: Logout button does not clear session
Affects: Langflow
n8n: Prototype Pollution enables confused-deputy execution via public webhooks
Affects: n8n
n8n: Stored XSS in Chat Trigger Node
Affects: n8n
n8n: Same-Origin XSS in Respond to Webhook Node
Affects: n8n
Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
Affects: Langflow
Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
Affects: Langflow
n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
Affects: n8n
vLLM: Incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
Affects: vLLM
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels
Affects: vLLM
vLLM: OOM Denial of Service via Audio Decompression Bomb
Affects: vLLM
vLLM: vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and…
Affects: vLLM
n8n: N8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook…
Affects: n8n
Jupyter: Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing…
Affects: Jupyter
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
Affects: LangChain
Keras: DiskIOStore permits path traversal through crafted layer names
Affects: Keras
LiteLLM: BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
Affects: LiteLLM
LiteLLM: BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
Affects: LiteLLM
LiteLLM: BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails…
Affects: LiteLLM
LiteLLM: BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
Affects: LiteLLM
LiteLLM: A security vulnerability has been detected in BerriAI litellm up to 1.82.2
Affects: LiteLLM
LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration
Affects: LiteLLM
Flowise: Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient…
Affects: Flowise
Jupyter: JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
Affects: Jupyter
vLLM: Image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input…
Affects: vLLM
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints
Affects: n8n
n8n: Public API Execution Retry Authorization Bypass
Affects: n8n
n8n: Python Code Node AST Validator Bypass
Affects: n8n
Flowise: FlowiseAI Vulnerable to Credential Data Leak
Affects: Flowise
Flowise: FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource…
Affects: Flowise
Weaviate: Weaviate has an Improper Authorization issue
Affects: Weaviate
Streamlit: Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission
Affects: Streamlit
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
Affects: MLflow
AnythingLLM: Prior to 1.13.0, an approved mobile device token created in single-user mode can survive…
Affects: AnythingLLM
Gradio: Gradio contains a cookie injection vulnerability
Affects: Gradio
vLLM: vllm has Improper Resource Shutdown or Release
Affects: vLLM
MLflow: MLflow authenticated users can enumerate any registered model versions due to lack of per-model…
Affects: MLflow
Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and…
Affects: Flowise
Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage
Affects: Flowise
n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions
Affects: n8n
Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)
Affects: Open WebUI
Open WebUI: Open WebUI has an Indirect Object Reference (IDOR) in user notes
Affects: Open WebUI
Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]
Affects: Open WebUI
Open WebUI: Open WebUI Exposes System Prompt to Regular User [Non-Admin]
Affects: Open WebUI
Open WebUI: Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function
Affects: Open WebUI
Open WebUI: Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer…
Affects: Open WebUI
Open WebUI: Open WebUI missing authorization check at the model update function - models from other users…
Affects: Open WebUI