# open-webui vulnerabilities & exploitation > As of 2026-10-05, Threadlinqs tracks 9 open-webui CVEs, 0 in the CISA Known Exploited Vulnerabilities catalog, linked to 1 tracked threat campaign. **Data as of:** 2026-10-05 ## Exploitation timeline Threadlinqs has recorded 9 open-webui CVEs published between 2026-06-15 and 2026-09-15. The busiest month was 2026-09 (8 new CVEs). None of them is listed in CISA KEV yet. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 9 of 9 tracked open-webui CVEs. - [CVE-2026-56399](https://intel.threadlinqs.com/cve/CVE-2026-56399) — MEDIUM 5 · EPSS 0.3% · 2026-06-30 - [CVE-2026-88000](https://intel.threadlinqs.com/cve/CVE-2026-88000) — MEDIUM 6.5 · EPSS 0.3% · 2026-09-09 - [CVE-2026-88002](https://intel.threadlinqs.com/cve/CVE-2026-88002) — MEDIUM 6.5 · EPSS 0.3% · 2026-09-09 - [CVE-2026-88001](https://intel.threadlinqs.com/cve/CVE-2026-88001) — MEDIUM 5 · EPSS 0.3% · 2026-09-09 - [CVE-2026-87998](https://intel.threadlinqs.com/cve/CVE-2026-87998) — HIGH 7.1 · EPSS 0.3% · 2026-09-09 - [CVE-2026-87999](https://intel.threadlinqs.com/cve/CVE-2026-87999) — HIGH 7.1 · EPSS 0.2% · 2026-09-09 - [CVE-2026-87994](https://intel.threadlinqs.com/cve/CVE-2026-87994) — MEDIUM 4.3 · EPSS 0.2% · 2026-09-09 - [CVE-2026-87997](https://intel.threadlinqs.com/cve/CVE-2026-87997) — MEDIUM 4.3 · EPSS 0.2% · 2026-09-09 - [CVE-2026-87017](https://intel.threadlinqs.com/cve/CVE-2026-87017) — MEDIUM 4.3 · EPSS 0.2% · 2026-09-09 ## Products affected Threadlinqs normalises CPE and CNA product records across all 9 CVEs; 1 distinct open-webui product is affected. The most frequently affected: - open-webui — 9 CVEs ## Threat activity 1 tracked threat campaign reference open-webui products or exploit open-webui CVEs: - [Qilin-Linked Campaign Exploits MCP Gateway and LLM Framework Flaws (CVE-2026-59822, CVE-2026-42271, CVE-2026-48710) for RCE and Cryptomining](https://intel.threadlinqs.com/threat/TL-2026-2185) — CRITICAL — 2026-08-28 ## How to prioritise open-webui patching This order follows the data Threadlinqs holds for open-webui, not a generic severity checklist: - No open-webui CVE is in CISA KEV yet, so rank by exploit probability instead. - Outside KEV, the highest EPSS scores are [CVE-2026-56399](https://intel.threadlinqs.com/cve/CVE-2026-56399) (0.3%), [CVE-2026-88000](https://intel.threadlinqs.com/cve/CVE-2026-88000) (0.3%), [CVE-2026-88002](https://intel.threadlinqs.com/cve/CVE-2026-88002) (0.3%). - 0 CVEs score Critical and 2 High on CVSS v3 (maximum 7.1, average 5.6); sequence these after KEV and high-EPSS items. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/open-webui All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp