open-webui vulnerabilities
- open-webui has 175 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #77 of 420 vendors on this site by that count.
- Of the 175 with a CVSS score, 83 (47.4%) are rated critical or high; 0 (0% of all) have no CVSS score.
- None of the CVE records attributed to open-webui is listed in CISA's KEV catalog as of 28 Oct 2026.
Records are attributed to open-webui from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 0 |
| 2018 | 0 |
| 2019 | 0 |
| 2020 | 0 |
| 2021 | 0 |
| 2022 | 0 |
| 2023 | 0 |
| 2024 | 5 |
| 2025 | 12 |
| 2026 | 158 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 158 | 2 | 72 | 46.8% | 0% |
| 2025 | 12 | 1 | 7 | 66.7% | 0% |
| 2024 | 5 | 0 | 1 | 20% | 0% |
| 2023 | 0 | 0 | 0 | — | — |
| 2022 | 0 | 0 | 0 | — | — |
| 2021 | 0 | 0 | 0 | — | — |
| 2020 | 0 | 0 | 0 | — | — |
| 2019 | 0 | 0 | 0 | — | — |
| 2018 | 0 | 0 | 0 | — | — |
| 2017 | 0 | 0 | 0 | — | — |
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring open-webui records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2024-7035 | 8.7% | 95.1% | Medium | No |
| CVE-2025-64496 | 7.2% | 94.3% | High | No |
| CVE-2026-34222 | 5% | 92.2% | High | No |
| CVE-2025-65958 | 4.4% | 91.3% | High | No |
| CVE-2026-28788 | 3% | 87.2% | High | No |
| CVE-2026-44551 | 1.5% | 73.5% | Critical | No |
| CVE-2024-6707 | 1% | 62.8% | High | No |
| CVE-2024-7983 | 0.9% | 58.9% | High | No |
| CVE-2026-45397 | 0.8% | 54.8% | Medium | No |
| CVE-2024-6706 | 0.7% | 51.3% | Medium | No |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.