Advisory Catalog

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

Flowise: Missing Authorization on Execution Update Endpoint

Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Flowise: Incomplete Credential Redaction Exposes Secrets via API

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Django GeoDjango vulnerable to denial of service through deeply nested geometry collections

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Flowise RCE via SQLite Record Manager Node

Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API