Security advisories

medium2026-07-24

CVE-2026-57497-webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

quic-go/webtransport-go · GHSA-g35j-m5xg-vh3q

high2026-07-24

CVE-2026-55502-Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

cloudreve/cloudreve · GHSA-hq88-5x99-x3gf

medium2026-07-24

CVE-2026-55499-Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

cloudreve/cloudreve · GHSA-w8x7-h2px-xmq8

medium2026-07-24

CVE-2026-55497-Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

cloudreve/cloudreve · GHSA-g9j2-8w95-3vwv

medium2026-07-24

CVE-2026-55496-Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

cloudreve/cloudreve · GHSA-8r7f-r8hj-r3rv

medium2026-07-24

CVE-2026-55495-Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

cloudreve/cloudreve · GHSA-49h3-cwhj-4737

high2026-07-24

CVE-2026-55404-yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

yt-dlp/yt-dlp · GHSA-6v4j-43gg-vj32

medium2026-07-24

CVE-2026-59222-Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

open-webui/open-webui · GHSA-gh7p-78x6-jw6m

low2026-07-24

CVE-2026-59215-Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

open-webui/open-webui · GHSA-73x5-h92w-xc2j

low2026-07-24

CVE-2026-59213-Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

open-webui/open-webui · GHSA-3wp3-xxj9-5jqq

medium2026-07-24

CVE-2026-59217-Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

open-webui/open-webui · GHSA-7r7x-gjvr-448g

high2026-07-24

CVE-2026-59216-Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

open-webui/open-webui · GHSA-74h3-cxq7-vc5q

high2026-07-24

CVE-2026-59714-Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

open-webui/open-webui · GHSA-x2ff-v5v8-m75m

high2026-07-24

CVE-2026-59219-Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

open-webui/open-webui · GHSA-855v-hq7w-jmjw

low2026-07-24

CVE-2026-59715-Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

open-webui/open-webui · GHSA-gmfw-g93r-vg53

medium2026-07-24

CVE-2026-59227-Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

open-webui/open-webui · GHSA-rqj7-6wrp-6g2g

medium2026-07-24

CVE-2026-59220-Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

open-webui/open-webui · GHSA-ffpj-xv5c-p3gw

low2026-07-24

CVE-2026-59226-Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

open-webui/open-webui · GHSA-mvx4-532p-xfm9

medium2026-07-24

CVE-2026-59218-Open WebUI: Account enumeration via observable login timing discrepancy

open-webui/open-webui · GHSA-7rw5-9f7q-xj36

high2026-07-24

CVE-2026-59214-Open WebUI: Stored web worker XSS via Pyodide

open-webui/open-webui · GHSA-4r2p-27mh-5m22