https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T19:06:14.762426+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-8053 CVE-2024-8053 — Improper Authentication in open-webui/open-webui 2026-10-17T19:06:14.764322+00:00

Affected: open-webui/open-webui

In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.

 https://cve.radiocsirt.org/vuln/ghsa-9vf8-xgwm-97r8 GHSA-9vf8-xgwm-97r8 — Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint 2026-10-17T19:06:14.764397+00:00

Affected: PyPI: open-webui

In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.