https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T09:52:34.503983+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/fkie_cve-2024-12537 fkie_cve-2024-12537 2026-10-18T09:52:34.506419+00:00

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

 https://cve.radiocsirt.org/vuln/ghsa-chf7-q7m5-fq92 GHSA-chf7-q7m5-fq92 — Open WebUI Uncontrolled Resource Consumption vulnerability 2026-10-18T09:52:34.506465+00:00

Affected: PyPI: open-webui, npm: open-webui

In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the `api/v1/utils/code/format` endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users.

 https://cve.radiocsirt.org/vuln/pysec-2026-1728 PYSEC-2026-1728 — Open WebUI Uncontrolled Resource Consumption vulnerability 2026-10-18T09:52:34.506494+00:00

Affected: PyPI: open-webui

In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the `api/v1/utils/code/format` endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users.