Loading the catalogue…
Loading the catalogue…
Live usage rolls up every five minutes. We surface the 12-week trend once enough requests have flowed through this app.
“Strong Sovereign posture for self-hosted Inference, but 93 open security advisories — including an unresolved critical authentication bypass — demand disciplined patch ops.”
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.
Public security, privacy and governance advisories that are still open. Each row carries a source link — these are factual claims, not editorial judgements.
lowUpstream change on open-webui: github_release 'v0.9.6' → 'v0.10.1', github_last_push '2026-06-22T22:25:22Z' → '2026-06-30T02:31:50Z', cve_count 93 → 98
other · open
Source ↗lowUpstream change on open-webui: github_last_push '2026-06-16T02:00:47Z' → '2026-06-22T22:25:22Z'
other · open
Source ↗lowUpstream change on open-webui: github_last_push '2026-06-08T21:52:55Z' → '2026-06-16T02:00:47Z', cve_count 77 → 93
other · open
Source ↗lowUpstream change on open-webui: github_last_push '2026-06-02T02:22:06Z' → '2026-06-08T21:52:55Z'
other · open
Source ↗lowUpstream change on open-webui: github_release 'v0.9.5' → 'v0.9.6', github_last_push '2026-05-15T00:34:23Z' → '2026-06-02T02:22:06Z'
other · open
lowUpstream change on open-webui: github_last_push '2026-05-11T23:47:27Z' → '2026-05-15T00:34:23Z'
other · open
Source ↗lowUpstream change on open-webui: github_release 'v0.9.2' → 'v0.9.5', github_last_push '2026-05-04T22:17:11Z' → '2026-05-11T23:47:27Z', cve_count 16 → 77
other · open
Source ↗lowUpstream change on open-webui: github_release None → 'v0.9.2', github_last_push None → '2026-05-04T22:17:11Z', cve_count None → 16
other · open
Source ↗How Open WebUI moves data between the client, the inference endpoint and any vendor-owned services.
OpenAI-compatible. Point Open WebUI at Stav, set the header, you're done.
# Open WebUI on Stav AI # OpenAI-compatible — drop the base URL in, swap your key, ship. OPENAI_API_KEY=$STAV_API_KEY OPENAI_BASE_URL=https://api.stav.ai/v1 # Header — Stav attributes usage to your registered app and respects # per-app routing policy. Send when the app supports custom headers. X-Stav-App-Id: open-webui
Setup notes · Read about sovereign routing →
What a model must support to work well with Open WebUI. Match these against the Stav model catalogue to pick an endpoint.
Live usage rolls up every five minutes. We surface the model mix once enough requests have flowed through this app.