Denial of Service

Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.

1. Denial of Service in open-webui/open-webuiCVE-2024-7983open-webui · CVSS 7.5 · 0.9% likely

   CWE-770

2. Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutCVE-2026-87011open-webui · CVSS 7.5 · 0.6% likely

   CWE-405

3. Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat treeCVE-2026-88000open-webui · CVSS 6.5 · 0.6% likely

   CWE-835

4. Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophicallyCVE-2026-70493open-webui · CVSS 6.5 · 0.6% likely

   CWE-1333

5. Open WebUI: Any authenticated user can hang the server via a cyclic chat message historyCVE-2026-88002open-webui · CVSS 6.5 · 0.6% likely

   CWE-835

6. Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsingCVE-2026-70489open-webui · CVSS 6.5 · 0.6% likely

   CWE-1333

7. Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default configCVE-2026-59220open-webui · CVSS 6.5 · 0.6% likely

   CWE-1333

8. Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycleCVE-2026-87013open-webui · CVSS 4.3 · 0.5% likely

   CWE-835

9. Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search RegexCVE-2026-109298open-webui · CVSS 6.5 · 0.5% likely

   CWE-770

10. Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule ValidationCVE-2026-109299open-webui · CVSS 6.5 · 0.4% likely

    CWE-400

11. Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence RulesCVE-2026-109297open-webui · CVSS 6.5 · 0.4% likely

    CWE-400

12. Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event LoopCVE-2026-109295open-webui · CVSS 4.3 · 0.3% likely

    CWE-1333

13. Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote ImageCVE-2026-109294open-webui · CVSS 6.5 · 0.3% likely

    CWE-409

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.