Sieve내 스택에 해당하는 LLM 보안 이슈만검색 /

검색

30건 · AI 관련·실제 악용·최신 순

중간취약점

Open WebUI Stored Cross-Site Scripting Vulnerability

PyPI open-webui · 0.3.14에서 수정 · GHSA-5jp3-wp5v-5363 · 2026. 10. 27.

높음취약점

Open WebUI has vulnerable dependency on starlette via fastapi

PyPI open-webui · 0.5.8에서 수정 · GHSA-w466-2wfc-8g58 · 2026. 10. 27.

중간취약점

open-webui Insecure Direct Object Reference (IDOR) vulnerability

PyPI open-webui · 0.6.3에서 수정 · GHSA-xcvc-5hgv-phqg · 2026. 10. 27.

중간취약점

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

PyPI open-webui · 0.11.1에서 수정 · GHSA-3pf7-q2g3-wj28 · 2026. 10. 2.

중간취약점

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

PyPI open-webui · 0.9.0에서 수정 · GHSA-4qg5-cxx4-g927 · 2026. 10. 2.

높음취약점

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

PyPI open-webui · 0.11.1에서 수정 · GHSA-34r3-9m95-vq73 · 2026. 10. 2.

높음취약점

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

PyPI open-webui · 0.11.1에서 수정 · GHSA-4v28-j6q3-5m4r · 2026. 10. 2.

높음취약점

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

PyPI open-webui · 0.11.1에서 수정 · GHSA-2724-6cpj-gf3v · 2026. 10. 2.

중간취약점

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

PyPI open-webui · 0.11.1에서 수정 · GHSA-fmqh-xp37-5hr8 · 2026. 10. 2.

중간취약점

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

PyPI open-webui · 0.11.1에서 수정 · GHSA-p78m-89r6-pgf7 · 2026. 10. 2.

높음취약점

Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

PyPI open-webui · 0.11.1에서 수정 · GHSA-jmc6-2wr8-h3wj · 2026. 10. 2.

중간취약점

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

PyPI open-webui · 0.11.1에서 수정 · GHSA-wvm9-9g5j-623f · 2026. 10. 2.

중간취약점

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

PyPI open-webui · 0.11.1에서 수정 · GHSA-wjwr-xfp9-r66p · 2026. 10. 2.

중간취약점

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

PyPI open-webui · 0.11.1에서 수정 · GHSA-8r35-5x5r-hv74 · 2026. 10. 2.

높음취약점

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

PyPI open-webui · 0.11.1에서 수정 · GHSA-wpmr-8h3q-fwj7 · 2026. 10. 2.

중간취약점

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

PyPI open-webui · 0.11.1에서 수정 · GHSA-v39v-59xw-j98g · 2026. 10. 2.

높음취약점

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

PyPI open-webui · 0.11.1에서 수정 · GHSA-3g9q-v48f-hh9w · 2026. 10. 2.

중간취약점

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

PyPI open-webui · 0.11.1에서 수정 · GHSA-pcvc-8vrv-8q6w · 2026. 10. 2.

중간취약점

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

PyPI open-webui · 0.11.1에서 수정 · GHSA-jqhh-cjmq-vmv6 · 2026. 9. 10.

중간취약점

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

PyPI open-webui · 0.11.1에서 수정 · GHSA-3cgp-3cqx-j8w2 · 2026. 9. 10.

중간취약점

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

PyPI open-webui · 0.11.1에서 수정 · GHSA-5x7x-4c3c-qf5w · 2026. 9. 10.

중간취약점

open-webui allows writing and deleting arbitrary files

PyPI open-webui · 수정 버전 없음 · GHSA-54f4-v6v9-9q82 · 2026. 9. 10.

높음취약점

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

PyPI open-webui · 0.11.0에서 수정 · GHSA-3xpf-xq7r-v8c5 · 2026. 8. 19.

중간취약점

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

PyPI open-webui · 0.11.0에서 수정 · GHSA-73cq-mcgh-379c · 2026. 8. 19.

높음취약점

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

PyPI open-webui · 0.11.0에서 수정 · GHSA-w2rx-84hp-gg95 · 2026. 8. 10.

높음취약점

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

PyPI open-webui · 0.11.0에서 수정 · GHSA-8x5v-cpv7-8jjp · 2026. 8. 10.

높음취약점

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

PyPI open-webui · 0.11.0에서 수정 · GHSA-rq84-p6rr-vf89 · 2026. 8. 10.

중간취약점

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

PyPI open-webui · 0.11.0에서 수정 · GHSA-5gpj-vj23-vhhv · 2026. 8. 10.

중간취약점

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

PyPI open-webui · 0.11.0에서 수정 · GHSA-mj5r-jf49-m3w7 · 2026. 8. 10.

낮음취약점

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

PyPI open-webui · 0.11.0에서 수정 · GHSA-3vf6-64vr-3g56 · 2026. 8. 10.