Skip to content
OpenAdvisories

Package · Wolfi

open-webui-compat

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.6
    CVE-2025-66416

    DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost

    The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an…

    Model Context Protocol python-sdk semgrep open-webui-compat Wolfi PyPI
  • High 8.3
    CVE-2025-65106

    LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

    LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerability exists in LangChain's prompt template system that allows attackers to access Python object interna…

    langchain-ai langchain open-webui open-webui-compat Wolfi PyPI
  • High 7.5
    CVE-2025-62727 Public exploit

    Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

    Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merg…

    Kludex starlette open-webui airflow-3 Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2025-6985

    XXE Vulnerability in langchain-ai/langchain

    The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed u…

    langchain-ai langchain-ai/langchain open-webui open-webui-compat Wolfi PyPI
  • High 7.5
    CVE-2025-59420

    Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

    Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker ca…

    authlib authlib open-webui python-authlib Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2025-6984

    Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain

    The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without d…

    langchain-ai langchain-ai/langchain open-webui open-webui-compat Wolfi PyPI