https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T22:38:06.334001+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-224013 EUVD-2026-224013 2026-10-17T22:38:06.336628+00:00 EUVD-2026-224013 https://cve.radiocsirt.org/vuln/fkie_cve-2024-7035 fkie_cve-2024-7035 2026-10-17T22:38:06.336659+00:00

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks, where an unaware user can unintentionally perform sensitive actions by simply visiting a malicious site or through top-level navigation. The affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. This impacts both the availability and integrity of the application.

 https://cve.radiocsirt.org/vuln/ghsa-p5vx-9hj8-cf4h GHSA-p5vx-9hj8-cf4h — Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) 2026-10-17T22:38:06.336689+00:00

Affected: PyPI: open-webui

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks, where an unaware user can unintentionally perform sensitive actions by simply visiting a malicious site or through top-level navigation. The affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. This impacts both the availability and integrity of the application.

 https://cve.radiocsirt.org/vuln/pysec-2026-1739 PYSEC-2026-1739 — Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) 2026-10-17T22:38:06.336714+00:00

Affected: PyPI: open-webui

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks, where an unaware user can unintentionally perform sensitive actions by simply visiting a malicious site or through top-level navigation. The affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. This impacts both the availability and integrity of the application.