Open WebUI: Open WebUI has Broken Access Control for Completions API
Affects: Open WebUI
Advisories
Security advisories for popular AI software, newest first, each linked to its public source.
331 advisories rated High
Open WebUI: Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature
Affects: Open WebUI
Open WebUI: Open WebUI's responses passthrough endpoint lacks access control authorization
Affects: Open WebUI
Open WebUI: Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
Affects: Open WebUI
Open WebUI: Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection…
Affects: Open WebUI
Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
Affects: Open WebUI
Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance…
Affects: Open WebUI
MLflow: Unauthenticated access to certain FastAPI routes
Affects: MLflow
Open WebUI: Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in…
Affects: Open WebUI
Flowise: Flowise has an MCP Security Bypass that Enables RCE
Affects: Flowise
Jupyter: JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious)…
Affects: Jupyter
LangChain: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary…
Affects: LangChain
vLLM: vLLM Vulnerable to Remote DoS via Special-Token Placeholders
Affects: vLLM
MLflow: MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's…
Affects: MLflow
MLflow: MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability
Affects: MLflow
LiteLLM: LiteLLM has a sandbox escape in custom-code guardrail
Affects: LiteLLM
Open WebUI: Open WebUI has a CORS misconfiguration and session validation issue
Affects: Open WebUI
Ray: From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types…
Affects: Ray
LiteLLM: From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before…
Affects: LiteLLM
LiteLLM: From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted…
Affects: LiteLLM
Keras: Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation…
Affects: Keras
Jupyter: Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`
Affects: Jupyter
Jupyter: Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to…
Affects: Jupyter
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, the MCP OAuth client registration endpoint…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML…
Affects: n8n
n8n: Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and…
Affects: n8n
n8n: Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters endpoints did not verify…
Affects: n8n
Langflow: IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read…
Affects: Langflow