Skip to content
OpenAdvisories

Package · Wolfi

open-webui

266 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-71554 Public exploit

    h2: Duplicate Host header could facilitate request smuggling

    h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP…

    python-hyper h2 open-webui airflow-3 Debian Ubuntu Wolfi PyPI
  • Medium 6.3
    CVE-2026-69243 Public exploit

    AIOHTTP: HTTP request smuggling via WebSocket upgrade

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to exec…

    aio-libs aiohttp open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 4.4
    CVE-2026-25645 Public exploit

    Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

    Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is…

    psf requests open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 6.3
    CVE-2026-27199 Public exploit

    Werkzeug safe_join() allows Windows special device names

    Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

    pallets werkzeug open-webui airflow-3 Alpine Wolfi PyPI
  • Medium 5.1
    CVE-2026-24688 Public exploit

    pypdf has possible Infinite Loop when processing outlines/bookmarks

    pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has b…

    py-pdf pypdf open-webui pypdf Debian Ubuntu Wolfi PyPI
  • Medium 6.3
    CVE-2025-66034 Public exploit

    fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

    fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malic…

    fonttools fonttools open-webui fonttools Debian Ubuntu Wolfi PyPI
  • Medium 6.4
    CVE-2025-61765 Public exploit

    python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments

    python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserializatio…

    miguelgrinberg python-socketio open-webui reflex Debian Ubuntu Wolfi PyPI