# Positive Technologies (dbugs)

Source: https://docs.openwebui.com/security/supply-chain-security/vulnerability-databases/positive-technologies

|  |  |
| --- | --- |
| Product | Positive Technologies vulnerability database (dbugs) |
| Records still shown as active | 9, every withdrawn identifier against Open WebUI |
| First contacted | 2026-08-08 |
| Channels tried | dbugs@ |
| Status | Awaiting response |

---

## Records

Every CVE withdrawn against Open WebUI still has a live dbugs entry, each with its own `PT-` identifier, a severity, a description of the defect and a recommendations section. Each identifier below is in the `REJECTED` state at [cve.org](https://www.cve.org) and at NVD:

| Identifier | Withdrawn by | Rejected since | Our assessment |
| --- | --- | --- | --- |
| CVE-2024-7033 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2024-7034 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2024-7038 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2024-7039 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2024-7040 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2024-7959 | huntr / Protect AI | 2026-07-16 | Disposition |
| CVE-2025-15603 | VulDB | 2026-06-18 | Disposition |
| CVE-2025-29446 | MITRE | 2026-06-29 | Disposition |
| CVE-2025-63391 | MITRE | 2026-06-29 | Disposition |

Two entries we can cite directly: [PT-2026-24109](https://dbugs.ptsecurity.com/vulnerability/PT-2026-24109) for CVE-2025-15603, and [PT-2025-17455](https://dbugs.ptsecurity.com/vulnerability/PT-2025-17455) for CVE-2025-29446.

### The entries tell operators what to do about it

dbugs entries carry a **Recommendations** section. The advice is specific, actionable and attached to identifiers that no longer exist.

**CVE-2025-29446** ([PT-2025-17455](https://dbugs.ptsecurity.com/vulnerability/PT-2025-17455), CVSS 3.1 rated 3.3 Low, last updated 2025-05-28) advises restricting access to the `verify_connection()` function in `routers/ollama.py` "until a patch is available", and suggests that disabling that function "may help minimize the risk of exploitation".

The identifier was withdrawn on 2026-06-29, so no patch is coming. An operator who follows that guidance disables working functionality and waits indefinitely, in response to a defect the issuing CNA has determined was never there.

**CVE-2025-15603** ([PT-2026-24109](https://dbugs.ptsecurity.com/vulnerability/PT-2026-24109)) similarly recommends upgrading to a version of Open WebUI later than 0.6.16 in order to remediate. That identifier was withdrawn on 2026-06-18.

Remediation guidance raises the cost of a stale record considerably. A wrong severity misinforms a reader. A wrong recommendation changes what they run.

### The record travels further than the database

The dbugs entry for CVE-2025-29446 lists nine references. Alongside NVD and OSV, they include four Telegram channel posts and two Twitter posts announcing the CVE and one reference already marked **Deleted**.

Those are broadcast channels. A post announcing a CVE is not revised when the identifier is withdrawn, and each one is a copy that outlives the record it came from. A rejection at cve.org reaches none of them.

---

## Contact log

| Date | Channel | Outcome |
| --- | --- | --- |
| 2026-08-08 | dbugs@ | Awaiting response |

---

## See also

- [Rejected CVEs in Vulnerability Databases](/security/supply-chain-security/vulnerability-databases/) — the overview and how to verify any record yourself.
- [Vendor Dispositions](/security/vendor-dispositions) — our assessment of each identifier listed above.