Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Unknownopenai-codex-0.162.1-2.1 on GA mediaOct 15, 2026
- High8.3Nginx UI OTP secure-session step-up is missing on sensitive mutation routesOct 12, 2026
- Medium5.3Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an expli…EPSS 0.3%Oct 12, 2026
- High7.6Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode ConnectionsEPSS 0.3%Oct 12, 2026
- Medium5.3The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2.EPSS 0.2%Sep 22, 2026
- High7.8ZDI-26-650: (Pwn2Own) OpenAI Codex External Control of Configuration Setting Remote Code Execution VulnerabilityEPSS 0.1%Sep 10, 2026
- High7.8ZDI-26-649: (Pwn2Own) OpenAI Codex Improper Neutralization of Control Sequences Remote Code Execution VulnerabilityEPSS 0.3%Sep 10, 2026
- High7.8ZDI-26-648: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution VulnerabilityEPSS 0.1%Sep 10, 2026
- Critical9.8ZDI-26-651: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution VulnerabilityEPSS 0.4%Sep 1, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6_dev_get() from resurrecting inet6_dev in6_dev_get() reads dev->ip6_ptr under RCU…EPSS 0.1%Aug 22, 2026
- Critical9.3Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header.Aug 21, 2026
- High7.7Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header.Aug 21, 2026
- High8.8BerriAI LiteLLM Improper Authentication VulnerabilityKEVEPSS 0.8%Jul 8, 2026
- Medium5.5A vulnerability was identified in vllm-project vllm 0.19.0.May 26, 2026
- Medium5.4Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.May 15, 2026
- High7.1Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.May 15, 2026
- High8.6LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.May 8, 2026
- High8.7BerriAI LiteLLM Command Injection VulnerabilityKEVEPSS 92.6%May 7, 2026
- Critical9.3BerriAI LiteLLM SQL Injection VulnerabilityKEVEPSS 5.8%May 7, 2026
- Low1.2A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3.May 5, 2026
- Low1.2A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3.May 5, 2026
- Low2.1A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3.May 5, 2026
- Medium6.5titra is an open source time tracking project.May 4, 2026
- Low3.1LangChain is a framework for building agents and LLM-powered applications.Apr 24, 2026
- Medium4.3The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11.Apr 24, 2026
44 records · page 1 of 2
PreviousNext