CVE-2025-15603

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor explains: "The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, start_windows.bat and `open-webui serve` all set or auto-generate WEBUI_SECRET_KEY before the backend imports env.py. It was only ever reachable by invoking uvicorn directly, which is unsupported and unsafe (the app would then sign tokens/cookies with a public, hardcoded key)."

Published

Mar 9, 2026

Last Modified

Jun 18, 2026

Status

Rejected

• CVE-2025-15595Privilege escalation via dll hijacking in Inno Setup 6.2.1 a…7.8
• CVE-2025-15597A vulnerability has been found in Dataease SQLBot up to 1.4.…6.3
• CVE-2025-15598A vulnerability was found in Dataease SQLBot up to 1.5.1. Th…5.9
• CVE-2025-15599DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contai…6.1
• CVE-2025-1560The WOW Entrance Effects (WEE!) plugin for WordPress is vuln…5.4
• CVE-2025-15602Snipe-IT versions prior to 8.3.7 contain sensitive user attr…8.8
• CVE-2025-15604Amon2 versions before 6.17 for Perl use an insecure random_s…9.8
• CVE-2025-15605A hardcoded cryptographic key within the configuration mecha…7.3
• CVE-2025-15606A Denial-of-Service (DoS) vulnerability in the httpd compone…7.5
• CVE-2025-15607A command injection vulnerability on AX53 v1 occurs in mscd …9.8
• CVE-2025-15608This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results…9.8
• CVE-2025-15609The Fortis for WooCommerce WordPress plugin before 1.3.1 may…7.5