How many Open WebUI open-webui/open-webui CVEs are in CISA KEV?

None of Open WebUI open-webui/open-webui's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Open WebUI open-webui/open-webui are affected?

1 distinct Open WebUI open-webui/open-webui version is named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Open WebUI open-webui/open-webui CVEs?

Open WebUI open-webui/open-webui's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-306 (Missing Authentication for Critical Function).

How many critical Open WebUI open-webui/open-webui vulnerabilities are there?

Open WebUI open-webui/open-webui has 1 critical and 4 high-severity CVEs.

What is the average severity of Open WebUI open-webui/open-webui CVEs?

The average CVSS base score across Open WebUI open-webui/open-webui's scored CVEs is 7.5.

RadicalNotion.AI

Log in Create an account

Open WebUI

8 CVEs

Open WebUI open-webui/open-webui Vulnerabilities

Name: Open WebUI open-webui/open-webui vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for open-webui/open-webui by Open WebUI.

8

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

8

Public exploits

PoC or exploit code

7.5

Avg CVSS

2024–2025

Last updated March 20, 2025

Overview

Open WebUI open-webui/open-webui has 8 published CVE records since 2024, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 8 have a known public exploit. The average CVSS base score across scored CVEs is 7.5.

Severity and exploitation

How the CVSS severity of Open WebUI open-webui/open-webui's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High4

Medium3

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Open WebUI open-webui/open-webui's CVEs are currently listed in CISA's KEV catalog.

Public exploits

8

8 of Open WebUI open-webui/open-webui's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Open WebUI open-webui/open-webui version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

<= latest8 CVEs

Find a version

8 CVEs

Sort

Critical vulnerability · 2025-03-20
CVE-2024-8017
Public exploit
CWE-79
Critical · CVSS 9.0
EPSS 0.6% (48th pct)2025-03-20
Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint
CVE-2024-8053
Public exploit
CWE-306
High · CVSS 8.2
EPSS 0.7% (50th pct)2025-03-20
Improper Access Control in open-webui/open-webui
CVE-2024-7043
Public exploit
CWE-862
High · CVSS 8.8
EPSS 0.6% (48th pct)2025-03-20
Denial of Service in open-webui/open-webui
CVE-2024-7983
Public exploit
CWE-770
High · CVSS 7.5
EPSS 0.9% (58th pct)2025-03-20
Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload
CVE-2024-7044
Public exploit
CWE-79
High · CVSS 8.9
EPSS 0.5% (44th pct)2025-03-20
Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2024-7035
Public exploit
CWE-352
Medium · CVSS 6.9
EPSS 8.5% (95th pct)2025-03-20
IDOR in open-webui/open-webui
CVE-2024-7048
Public exploit
CWE-863
Medium · CVSS 5.4
EPSS 0.4% (30th pct)2024-10-10
IDOR in open-webui/open-webui
CVE-2024-7041
Public exploit
CWE-639
Medium · CVSS 5.7
EPSS 0.4% (29th pct)2024-10-09

Common weakness types

The CWE weakness categories most often found in Open WebUI open-webui/open-webui CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Open WebUI open-webui/open-webui CVEs were published each year.

2024

2

2025

6

Other Open WebUI products

Browse vulnerabilities for other products by Open WebUI.

open-webui197 CVEs open webui175 CVEs open-webu1 CVEs

All Open WebUI vulnerabilities

Frequently asked questions

Common questions about Open WebUI open-webui/open-webui vulnerabilities.

How many CVEs does Open WebUI open-webui/open-webui have?: Open WebUI open-webui/open-webui has 8 published CVE records since 2024.
How many Open WebUI open-webui/open-webui CVEs are in CISA KEV?: None of Open WebUI open-webui/open-webui's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Open WebUI open-webui/open-webui vulnerabilities?: Yes — 8 of Open WebUI open-webui/open-webui's CVEs have a known public exploit.
Which versions of Open WebUI open-webui/open-webui are affected?: 1 distinct Open WebUI open-webui/open-webui version is named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Open WebUI open-webui/open-webui CVEs?: Open WebUI open-webui/open-webui's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-306 (Missing Authentication for Critical Function).
How many critical Open WebUI open-webui/open-webui vulnerabilities are there?: Open WebUI open-webui/open-webui has 1 critical and 4 high-severity CVEs.
What is the average severity of Open WebUI open-webui/open-webui CVEs?: The average CVSS base score across Open WebUI open-webui/open-webui's scored CVEs is 7.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Open WebUI open-webui/open-webui vulnerabilities

Get an alert for each new Open WebUI open-webui/open-webui CVE, with AI-written analysis and remediation steps.

Create an account See pricing