Skip to content
OpenAdvisories

Package · Wolfi

open-webui

266 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.7
    CVE-2026-96778 Public exploit

    Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

    Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte b…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.8
    CVE-2026-104851 Public exploit

    fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

    fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Templa…

    fsspec filesystem_spec open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  • High 8.6
    CVE-2026-24486 Public exploit

    Python-Multipart has Arbitrary File Write via Non-Default Configuration

    Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbi…

    Kludex python-multipart open-webui airflow-3 Debian Ubuntu Wolfi PyPI
  • High 8.2
    CVE-2026-0994 Public exploit

    Denial of Service in Python Protobuf

    A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…

    Python Protobuf mysql open-webui Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.1
    CVE-2026-24049 Public exploit

    wheel Allows Arbitrary File Permission Modification via Path Traversal

    wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic b…

    pypa wheel open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • High 7.5
    CVE-2025-62727 Public exploit

    Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

    Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merg…

    Kludex starlette open-webui airflow-3 Debian Ubuntu Wolfi PyPI