Vulnerability Search Top
Show Search Menu
Vendor Name
プロダクト・サービス名
Title
CVE
Urgent
Important
Warning
Warning
CWE
公開-検索開始年
公開-検索開始月
公開-検索開始日
公開-検索終了年
公開-検索終了月
公開-検索終了日
レベルソート
In descending order of publication date
In descending order of update date
Number of items displayed

You can search for vulnerabilities managed by JVN (Japan Vulnerability Note) and NVD (National Vulnerability Database).
Search keywords must be entered in English otherwise will not be searched in both JVN and NVD.

To search by CWE, please refer to the CWE Overview and check the CWE number.

  • Urgent
  • Important
  • Warning
  • Low
JVN Vulnerability Information

Update Date":May 18, 2026, 6 p.m.

No CVSS Level
Attach Vector		 Vendor Name Project Name Title CWE CVE Update Date Publication Date Impact
Show		 Exploit
PoC
Search
244951 4.3 警告 Bitweaver - Bitweaver におけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング（XSS） 		CVE-2007-6374 2012-06-26 15:54 2007-12-14 Show GitHub Exploit DB Packet Storm
244952 7.5 危険 gestdown - GestDown における任意の SQL コマンドを実行される脆弱性 CWE-89
SQLインジェクション 		CVE-2007-6373 2012-06-26 15:54 2007-12-14 Show GitHub Exploit DB Packet Storm
244953 5 警告 ezcontents - ezContents の index.php におけるディレクトリトラバーサルの脆弱性 CWE-22
パス・トラバーサル 		CVE-2007-6368 2012-06-26 15:54 2007-12-14 Show GitHub Exploit DB Packet Storm
244954 4.3 警告 bcoos - bcoos の modules/ecal/display.php におけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング（XSS） 		CVE-2007-6365 2012-06-26 15:54 2007-12-14 Show GitHub Exploit DB Packet Storm
244955 5 警告 gekkoware - Gekko における temp/ 配下の特定のファイルを読み取られる脆弱性 CWE-264
認可・権限・アクセス制御 		CVE-2007-6361 2012-06-26 15:54 2007-12-14 Show GitHub Exploit DB Packet Storm
244956 4.9 警告 glyph and cog - alternate pdftops filter の pdftops.pl における任意のファイルを上書きされる脆弱性 CWE-DesignError
CVE-2007-6358 2012-06-26 15:54 2007-12-3 Show GitHub Exploit DB Packet Storm
244957 5 警告 aertherwide - exiftags におけるサービス運用妨害 (DoS) の脆弱性 CWE-399
リソース管理の問題 		CVE-2007-6356 2012-06-26 15:54 2007-12-18 Show GitHub Exploit DB Packet Storm
244958 6.8 警告 アカマイテクノロジーズ - Akamai Download Manager ActiveX コントロール (DownloadManagerV2.ocx) における任意のファイルを強制実行される脆弱性 CWE-94
コード・インジェクション 		CVE-2007-6339 2012-06-26 15:54 2008-05-1 Show GitHub Exploit DB Packet Storm
244959 10 危険 aertherwide - exiftags における整数オーバーフローの脆弱性 CWE-189
数値処理の問題 		CVE-2007-6355 2012-06-26 15:54 2007-12-18 Show GitHub Exploit DB Packet Storm
244960 10 危険 aertherwide - exiftags における詳細不明な脆弱性 CWE-noinfo
情報不足 		CVE-2007-6354 2012-06-26 15:54 2007-12-18 Show GitHub Exploit DB Packet Storm
NVD Vulnerability Information

Update Date:May 19, 2026, 4:16 a.m.

No CVSS Level
Attach Vector		 Vendor Name Project Name Title CWE CVE Update Date Publication Date Show Affected Exploit
PoC
Search
101 7.1 HIGH
Network 		- - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /responses endpoint in the OpenAI router accepts any authenticated user and forw… New CWE-284
CWE-862
Improper Access Control
 Missing Authorization 		CVE-2026-44556 2026-05-19 02:36 2026-05-16 Show GitHub Exploit DB Packet Storm
102 4.3 MEDIUM
Network 		- - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the _validate_collection_access function uses an incomplete allowlist that only enfo… New CWE-863
 Incorrect Authorization 		CVE-2026-44557 2026-05-19 02:36 2026-05-16 Show GitHub Exploit DB Packet Storm
103 6.5 MEDIUM
Network 		- - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the POST /api/v1/models/import endpoint allows users with the workspace.models_impor… New CWE-283
CWE-862
 Unverified Ownership
 Missing Authorization 		CVE-2026-44562 2026-05-19 02:36 2026-05-16 Show GitHub Exploit DB Packet Storm
104 5.4 MEDIUM
Network 		- - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /api/generate, /api/embed, /api/embeddings, and /api/show endpoints accept any m… New CWE-862
 Missing Authorization 		CVE-2026-44563 2026-05-19 02:36 2026-05-16 Show GitHub Exploit DB Packet Storm
105 5.4 MEDIUM
Network 		- - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the ydoc:document:update Socket.IO event handler checks whether the sender is a memb… New CWE-863
 Incorrect Authorization 		CVE-2026-44564 2026-05-19 02:36 2026-05-16 Show GitHub Exploit DB Packet Storm
106 4.8 MEDIUM
Network 		- - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the AccountPending.svelte component renders the admin-configured "Pending User Overl… New CWE-79
Cross-site Scripting 		CVE-2026-44568 2026-05-19 02:36 2026-05-16 Show GitHub Exploit DB Packet Storm
107 6.5 MEDIUM
Network 		- - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI allows admins to restrict which API endpoints an API key can access. When… New CWE-863
 Incorrect Authorization 		CVE-2026-45339 2026-05-19 02:36 2026-05-16 Show GitHub Exploit DB Packet Storm
108 7.1 HIGH
Network 		- - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a user just needs to use the API endpoint: /api/chat/completions with their own API … New CWE-639
 Authorization Bypass Through User-Controlled Key 		CVE-2026-45349 2026-05-19 02:36 2026-05-16 Show GitHub Exploit DB Packet Storm
109 8.5 HIGH
Network 		- - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, validate_url() in backend/open_webui/retrieval/web/utils.py calls validators.ipv6(ip… New CWE-918
Server-Side Request Forgery (SSRF)  		CVE-2026-45331 2026-05-19 02:36 2026-05-16 Show GitHub Exploit DB Packet Storm
110 7.1 HIGH
Network 		- - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user with low privileges can enumerate active background tasks acr… New CWE-862
 Missing Authorization 		CVE-2026-45399 2026-05-19 02:36 2026-05-16 Show GitHub Exploit DB Packet Storm