CVEs published March 20, 2025
369 CVEs were published on March 20, 2025: 47 critical, 185 high.
- Published
- 369
- Critical
- 47
- High
- 185
- Medium
- 124
- Low
- 13
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 131
Most affected products
- lunary-ai/lunary
- 22
- binary-husky/gpt_academic
- 20
- aimhubio/aim · aim
- 12
- danny-avila/librechat
- 11
- langgenius/dify
- 11
- danswer-ai/danswer
- 10
- h2oai/h2o-3 · h2o +1
- 10
- parisneo/lollms-webui
- 10
- gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- 9
- mintplex-labs/anything-llm
- 9
Critical 47
- CVE-2025-2538BUG-000174336Esri Portal for ArcGIS
- CVE-2025-29980Blind SQL Injection vulnerability in eTRAKiT.NetCentralSquare eTRAKiT.Net
- CVE-2025-29922kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspacekcp-dev kcp · github.com/kcp-dev/kcp
- CVE-2025-23120A vulnerability allowing remote code execution (RCE) for domain users.Veeam Backup and Recovery
- CVE-2025-2311Authentication Bypass in Sechard Information Technologies' SecHardSechard Information Technologies SecHard
- CVE-2024-8196Missing Authentication for Critical Function in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-8017Cross-site Scripting (XSS) in open-webui/open-webuiopen-webui/open-webui
- CVE-2024-8769Arbitrary File Deletion via Relative Path Traversal in aimhubio/aimaimhubio/aim · aim
- CVE-2024-5752Path Traversal in stitionai/devikastitionai/devika
- CVE-2024-10834Arbitrary File Write in eosphoros-ai/db-gpteosphoros-ai/db-gpt
- CVE-2024-8537Path Traversal in modelscope/agentscopemodelscope/agentscope · agentscope
- CVE-2024-6829Arbitrary File Overwrite through tarfile-extraction in aimhubio/aimaimhubio/aim · aim
- CVE-2024-11958SQL Injection in run-llama/llama_indexrun-llama/llama_index · llama-index-retrievers-duckdb-retri…
- CVE-2024-11041Remote Code Execution in vllm-project/vllmvllm-project/vllm · vllm
- CVE-2024-7957Arbitrary File Overwrite in danswer-ai/danswerdanswer-ai/danswer
- CVE-2024-8551Path Traversal in modelscope/agentscopemodelscope/agentscope · agentscope
- CVE-2024-10833Arbitrary File Write in eosphoros-ai/db-gpteosphoros-ai/db-gpt · dbgpt
- CVE-2024-8954Authentication Bypass in composiohq/composiocomposiohq/composio
- CVE-2024-9070Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentomlbentoml/bentoml · bentoml
- CVE-2024-11045Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webuiautomatic1111/stable-diffusion-webui
- CVE-2024-12433Remote Code Execution in infiniflow/ragflowinfiniflow/ragflow
- CVE-2024-9701Remote Code Execution in kedro-org/kedrokedro-org/kedro · kedro
- CVE-2024-12044Remote Code Execution by Pickle Deserialization in open-mmlab/mmdetectionopen-mmlab/mmdetection
- CVE-2024-10190Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovodhorovod/horovod · horovod
- CVE-2024-11167Improper Access Control in danny-avila/librechatdanny-avila/librechat
- CVE-2024-9309SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llavahaotian-liu/llava
- CVE-2024-10901Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpteosphoros-ai/db-gpt · dbgpt
- CVE-2024-8502Remote Code Execution via Deserialization in modelscope/agentscopemodelscope/agentscope · agentscope
- CVE-2024-9053Remote Code Execution in vllm-project/vllmvllm-project/vllm · vllm
- CVE-2024-10835Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpteosphoros-ai/db-gpt · dbgpt
- CVE-2024-8581Path Traversal in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-12909SQL Injection to RCE in run-llama/llama_indexrun-llama/llama_index · llama-index-packs-finchat
- CVE-2024-10902Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpteosphoros-ai/db-gpt · dbgpt
- CVE-2024-10831Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpteosphoros-ai/db-gpt · dbgpt
- CVE-2024-10553Jdbc Deserialization in h2oai/h2o-3h2oai/h2o-3 · h2o +1
- CVE-2024-11042Arbitrary File Delete in invoke-ai/invokeaiinvoke-ai/invokeai · invokeai
- CVE-2024-8999Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-8019Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightninglightning-ai/pytorch-lightning · pytorch-lightning +1
- CVE-2024-9095Improper Authorization in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-12029Remote Code Execution via Model Deserialization in invoke-ai/invokeaiinvoke-ai/invokeai · invokeai
- CVE-2024-47552Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata ServerApache Software Foundation Apache Seata · org.apache.seata:…
- CVE-2025-2505Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'philsbury Age Gate
- CVE-2024-12016SQLi in CM Informatics' CM NewsCM Informatics CM News
- CVE-2024-48590Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService.
- CVE-2025-26852DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection.Descor Infocad FM
- CVE-2025-26853DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema.Descor Infocad FM
- CVE-2025-29411An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute a
High 185
- CVE-2024-44305This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2024-44199An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2024-54551The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-30160Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Formredlib-org redlib · redlib
- CVE-2025-2480Santesoft Sante DICOM Viewer Pro Out-of-bounds WriteSantesoft Sante DICOM Viewer Pro
- GHSA-W466-2WFC-8G58Open WebUI has vulnerable dependency on starlette via fastapiopen-webui
- CVE-2024-13921Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameterwebtoffee Order Export & Order Import for WooCommerce
- CVE-2025-2539File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Readthomstark File Away
- CVE-2024-13558NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosuregplsaver NP Quote Request for WooCommerce
- CVE-2024-13923Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Functionwebtoffee Order Export & Order Import for WooCommerce
- CVE-2024-10956Cross-Site WebSocket Hijacking in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-12215Remote Code Execution in kedro-org/kedrokedro-org/kedro · kedro
- CVE-2024-8613Improper Access Control in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-9216Authentication Bypass in gaizhenbiao/ChuanhuChatGPTgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-6825Remote Code Execution in BerriAI/litellmberriai/litellm · litellm
- CVE-2024-7764SQL Injection in vanna-ai/vannavanna-ai/vanna
- CVE-2024-12063Denial of Service in imartinez/privategptimartinez/privategpt
- CVE-2024-10549Denial of Service by ReDOS in h2oai/h2o-3h2oai/h2o-3 · h2o +1
- CVE-2024-8248Path Traversal in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-12866Local File Inclusion in netease-youdao/qanythingnetease-youdao/qanything
- CVE-2025-0454SSRF Check Bypass in Requests Utility in significant-gravitas/autogptsignificant-gravitas/autogpt
- CVE-2024-8101Stored XSS in aimhubio/aimaimhubio/aim
- CVE-2024-10650Denial of Service (DoS) in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-12048IDOR Vulnerability in transformeroptimus/superagitransformeroptimus/superagi
- CVE-2024-8487CORS Vulnerability in modelscope/agentscopemodelscope/agentscope · agentscope
- CVE-2024-12766SSRF in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-11300Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-10830Path Traversal in eosphoros-ai/db-gpteosphoros-ai/db-gpt · dbgpt
- CVE-2024-8524Directory Traversal in modelscope/agentscopemodelscope/agentscope · agentscope
- CVE-2024-8736Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-12070Denial of Service in haotian-liu/llavahaotian-liu/llava
- CVE-2024-8958Unrestricted File Write and Read in composiohq/composiocomposiohq/composio
- CVE-2024-11030SSRF in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-4990Unsafe Reflection in base Component class in yiisoft/yii2yiisoft/yii2
- CVE-2024-11043Denial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeaiinvoke-ai/invokeai · invokeai
- CVE-2024-8053Improper Authentication in open-webui/open-webuiopen-webui/open-webui · open-webui
- CVE-2024-10648Path Traversal in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2024-8183CORS Misconfiguration in prefecthq/prefectprefecthq/prefect · prefect
- CVE-2024-10272Broken Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2025-1040Server-Side Template Injection (SSTI) in significant-gravitas/autogptsignificant-gravitas/autogpt
- CVE-2024-8062Denial of Service in h2oai/h2o-3h2oai/h2o-3 · h2o +1
- CVE-2024-8998Regular Expression Denial of Service (ReDoS) in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-8026CSRF due to overly permissive CORS headers in netease-youdao/qanythingnetease-youdao/qanything
- CVE-2024-8966Denial of Service in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2024-10912Denial of Service in lm-sys/fastchatlm-sys/fastchat · fschat
- CVE-2024-7776Arbitrary File Overwrite in onnx/onnxonnx/onnx · onnx
- CVE-2024-10569Zip Bomb Vulnerability in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2024-8953Unsafe eval usage in composiohq/composiocomposiohq/composio · composio-core
- CVE-2024-8063Divide by Zero in ollama/ollamaollama/ollama · github.com/ollama/ollama
- CVE-2024-10986Local File Read (LFI) by Tarslip Symlink via arxiv_download() API in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2025-0189Denial of Service in aimhubio/aimaimhubio/aim · aim
- CVE-2024-11602CORS Vulnerability in feast-dev/feastfeast-dev/feast · feast
- CVE-2025-0312NULL Pointer Dereference in ollama/ollamaollama/ollama · github.com/ollama/ollama
- CVE-2024-10051Unauthenticated Denial of Service in shaunwei/realcharshaunwei/realchar
- CVE-2025-1451Insufficient Patch Leading to DoS in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-7768Denial of Service in h2oai/h2o-3h2oai/h2o-3 · h2o +1
- CVE-2024-10188Denial of Service in BerriAI/litellmberriai/litellm · litellm
- CVE-2024-12864Unauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanythingnetease-youdao/qanything
- CVE-2024-10954Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim`binary-husky/gpt_academic
- CVE-2025-0628Improper Authorization in BerriAI/litellmberriai/litellm · litellm
- CVE-2025-0281Stored Cross-Site Scripting (XSS) in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-12389Path Traversal in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-10624Regular Expression Denial of Service (ReDoS) in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2025-0187Denial of Service (DoS) by Sending Large Filename at File Upload Endpoint in gradio-app/gradiogradio-app/gradio
- CVE-2024-12776Authentication Bypass in langgenius/difylanggenius/dify
- CVE-2024-9229Denial of Service (DoS) via Multipart Boundary in stangirard/quivrstangirard/quivr · quivr-core
- CVE-2024-10252Code Injection in langgenius/difylanggenius/dify
- CVE-2024-9437Unauthenticated Denial of Service in transformeroptimus/superagitransformeroptimus/superagi
- CVE-2024-7043Improper Access Control in open-webui/open-webuiopen-webui/open-webui · open-webui
- CVE-2024-9099Exposure of Private API Keys in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-8765Improper Path Equivalence Resolution in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-10950Code Injection in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-12390Remote Code Execution in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-7983Denial of Service in open-webui/open-webuiopen-webui/open-webui · open-webui
- CVE-2024-10714Denial of Service in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-9439Remote Code Execution in transformeroptimus/superagitransformeroptimus/superagi
- CVE-2024-10720Stored Cross-site Scripting (XSS) in phpipam/phpipamphpipam/phpipam
- CVE-2024-6982Remote Code Execution in Calculate Function in parisneo/lollmsparisneo/lollms · lollms
- CVE-2024-8018Denial of Service (DOS) in imartinez/privategptimartinez/privategpt
- CVE-2024-12882SSRF in comfyanonymous/comfyuicomfyanonymous/comfyui
- CVE-2024-12376Server Side Request Forgery in lm-sys/fastchatlm-sys/fastchat · fschat
- CVE-2024-8789Regular Expression Denial of Service (ReDoS) in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-12886Out-Of-Memory (OOM) Vulnerability in ollama/ollamaollama/ollama · github.com/ollama/ollama
- CVE-2024-6842Exposure of Sensitive Information in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-10819CSRF to XSS in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-8616Arbitrary File Overwrite in h2oai/h2o-3h2oai/h2o-3 · h2o +1
- CVE-2024-8055Local File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vannavanna-ai/vanna
- CVE-2024-11171Improper Input Validation in danny-avila/librechatdanny-avila/librechat
- CVE-2024-10907Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchatlm-sys/fastchat · fschat
- CVE-2024-9056Denial of Service in bentoml/bentomlbentoml/bentoml · bentoml
- CVE-2024-10550Denial of Service by ReDOS in h2oai/h2o-3h2oai/h2o-3 · h2o +1
- CVE-2024-12778Denial of Service in aimhubio/aimaimhubio/aim · aim
- CVE-2024-8061Denial of Service in aimhubio/aimaimhubio/aim · aim
- CVE-2024-8024CORS Misconfiguration in netease-youdao/qanythingnetease-youdao/qanything
- CVE-2024-11172Denial of Service in danny-avila/librechatdanny-avila/librechat
- CVE-2024-10906Cross-Site Request Forgery (CSRF) in eosphoros-ai/db-gpteosphoros-ai/db-gpt · dbgpt
- CVE-2024-8065CSRF in danswer-ai/danswerdanswer-ai/danswer
- CVE-2024-10264HTTP Request Smuggling in netease-youdao/qanythingnetease-youdao/qanything
- CVE-2025-0317Divide By Zero in ollama/ollamaollama/ollama · github.com/ollama/ollama
- CVE-2024-11603Server-Side Request Forgery in lm-sys/fastchatlm-sys/fastchat · fschat
- CVE-2025-0182Denial of Service in danswer-ai/danswerdanswer-ai/danswer
- CVE-2024-11169Unhandled Exception Leading to Server Crash in danny-avila/librechatdanny-avila/librechat
- CVE-2024-11039Deserialization of Untrusted Data in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-6854Arbitrary File Overwrite in h2oai/h2o-3h2oai/h2o-3 · h2o +1
- CVE-2024-9919Missing Authentication Check in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-6827HTTP Request Smuggling in benoitc/gunicornbenoitc/gunicorn · gunicorn
- CVE-2024-6851Arbitrary File Deletion in aimhubio/aimaimhubio/aim · aim
- CVE-2024-4023Stored XSS in flatpressblog/flatpressflatpressblog/flatpress
- CVE-2024-8859Path Traversal in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2024-8028Denial of Service in danswer-ai/danswerdanswer-ai/danswer
- CVE-2024-10935Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webuiautomatic1111/stable-diffusion-webui
- CVE-2024-10513Path Traversal in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-10829Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpteosphoros-ai/db-gpt · dbgpt
- CVE-2024-8438Path Traversal in modelscope/agentscopemodelscope/agentscope · agentscope
- CVE-2024-12065Local File Inclusion in haotian-liu/llavahaotian-liu/llava
- CVE-2025-0315Allocation of Resources Without Limits or Throttling in ollama/ollamaollama/ollama · github.com/ollama/ollama
- CVE-2024-9362Directory Traversal in polyaxon/polyaxonpolyaxon/polyaxon
- CVE-2024-8099Server-Side Request Forgery (SSRF) in vanna-ai/vannavanna-ai/vanna
- CVE-2024-9699Cross-Site Scripting (XSS) in flatpressblog/flatpressflatpressblog/flatpress
- CVE-2024-12911SQL Injection in run-llama/llama_indexrun-llama/llama_index · llama-index
- CVE-2024-10267Information Disclosure in transformeroptimus/superagitransformeroptimus/superagi
- CVE-2024-9096Improper Authorization in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-8249Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-9098Privilege Escalation in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-12880Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflowinfiniflow/ragflow
- CVE-2024-10366IDOR in delete attachments in danny-avila/librechatdanny-avila/librechat
- CVE-2024-8764Improper Authorization in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-10762Missing Authorization in lunary-ai/lunarylunary-ai/lunary
- CVE-2025-0330Exposure of Sensitive Information in berriai/litellmberriai/litellm · litellm
- CVE-2024-12039Improper Restriction of Excessive Authentication Attempts in langgenius/difylanggenius/dify
- CVE-2024-9597Path Traversal in parisneo/lollmsparisneo/lollms
- CVE-2024-12216Arbitrary File Write via TarSlip in dmlc/gluon-cvdmlc/gluon-cv · gluoncv
- CVE-2024-10572Denial of Service and Arbitrary File Write in h2oai/h2o-3h2oai/h2o-3 · h2o +1
- CVE-2024-10109Incorrect Authorization in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-8020Denial of Service in lightning-ai/pytorch-lightninglightning-ai/pytorch-lightning · pytorch-lightning +1
- CVE-2024-8489CSRF due to overly permissive CORS headers in modelscope/agentscopemodelscope/agentscope
- CVE-2024-9000Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-9606Improper Output Neutralization for Logs in berriai/litellmberriai/litellm · litellm
- CVE-2024-10110Denial of Service in aimhubio/aimaimhubio/aim · aim
- CVE-2024-9363Unauthorized File Deletion in polyaxon/polyaxonpolyaxon/polyaxon
- CVE-2024-9847Cross-Site Request Forgery (CSRF) in flatpressblog/flatpressflatpressblog/flatpress
- CVE-2024-8984Denial of Service (DoS) in berriai/litellmberriai/litellm · litellm
- CVE-2024-10821Denial of Service (DoS) in invoke-ai/invokeaiinvoke-ai/invokeai · invokeai
- CVE-2024-11031SSRF in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-10275Improper Role Modification by Admins for Billing Permissions in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-8156Command Injection in significant-gravitas/autogptsignificant-gravitas/autogpt
- CVE-2025-0185Pandas Query Injection in langgenius/difylanggenius/dify
- CVE-2024-10361Arbitrary File Deletion via Path Traversal in danny-avila/librechatdanny-avila/librechat
- CVE-2024-2292Access Control Vulnerabilities lead to Violation of Privacy and Modification of Personal Datachangeweb/unifiedtransform
- CVE-2024-12704Denial of Service (DoS) in run-llama/llama_indexrun-llama/llama_index · llama-index +1
- CVE-2024-9415Path Traversal in transformeroptimus/superagitransformeroptimus/superagi
- CVE-2024-7760CSRF in aimhubio/aimaimhubio/aim · aim
- CVE-2024-7819CORS Misconfiguration in danswer-ai/danswerdanswer-ai/danswer
- CVE-2024-11137IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-11170Path Traversal in danny-avila/librechatdanny-avila/librechat
- CVE-2024-12068Server-Side Request Forgery in haotian-liu/llavahaotian-liu/llava
- CVE-2024-8763Regular Expression Denial of Service (ReDoS) in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-12761Denial of Service in brycedrennan/imaginairybrycedrennan/imaginairy · imaginairy
- CVE-2024-10225Denial of Service in haotian-liu/llavahaotian-liu/llava
- CVE-2024-11449Server-Side Request Forgery in haotian-liu/llavahaotian-liu/llava
- CVE-2024-7779ReDoS (Regular Expression Denial of Service) in danswer-ai/danswerdanswer-ai/danswer
- CVE-2025-0452Arbitrary File Deletion in eosphoros-ai/DB-GPTeosphoros-ai/db-gpt
- CVE-2024-9340Denial of Service (DoS) via Multipart Boundary in zenml-io/zenmlzenml-io/zenml · zenml
- CVE-2024-11302Missing check_access in lollms_binding_infos in parisneo/lollmsparisneo/lollms
- CVE-2025-0190Denial of Service in aimhubio/aimaimhubio/aim · aim
- CVE-2024-12055DoS using malicious gguf model file in ollama/ollamaollama/ollama · github.com/ollama/ollama
- CVE-2024-10713Denial of Service (DoS) via Multipart Request in szad670401/hyperlprszad670401/hyperlpr · hyperlpr3
- CVE-2025-1796Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/difylanggenius/dify
- CVE-2024-7765Denial of Service in h2oai/h2o-3h2oai/h2o-3 · h2o +1
- CVE-2024-8501Arbitrary File Download in modelscope/agentscopemodelscope/agentscope · agentscope
- CVE-2025-1385Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configurationClickHouse OSS
- CVE-2024-13881LinkMyPosts <= 1.0 - Reflected XSSLink My Posts
- CVE-2024-13880My Quota <= 1.0.8 - Reflected XSSMy Quota
- CVE-2024-13878SpotBot <= 0.1.8 - Reflected XSSSpotBot
- CVE-2024-13877Passbeemedia Web Push Notifications <= 1.0.0 - Reflected XSSPassbeemedia Web Push Notification
- CVE-2024-13876Meintopf <= 0.2.1 - Reflected XSSmEintopf
- CVE-2024-13875WP Programmmanager <= 1.2 - Reflected XSSWP-PManager
- CVE-2025-22228CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password lengthSpring Security · org.springframework.security:spring-secur…
- CVE-2025-1770Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusionarraytics Eventin – Event Calendar, Event Registration, Tic…
- CVE-2024-57440D-Link DSL-3788 revA1 1.01R1B036_EU_EN is vulnerable to Buffer Overflow via the COMM_MAKECustomMsg function of the webproc cgi
- CVE-2025-25758An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANd
- CVE-2025-29101Tenda AC8V4.0 V16.03.34.06 was discovered to contain a stack overflow via the deviceid parameter in the get_parentControl_list_Info function
- CVE-2025-29121A vulnerability was found in Tenda AC6 V15.03.05.16.
- CVE-2025-29149Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function.
- CVE-2025-29214Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at /goform/setMacFilterCfg.
Medium, low and unrated 137
- CVE-2024-54564This issue was addressed through improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2025-2574Out-of-bounds array write in Xpdf 4.05 due to incorrect integer overflow checkingXpdf
- CVE-2025-30334OpenBSD wg(4) kernel crashOpenBSD
- CVE-2025-2557Audi UTR Dashcam Command API access controlAudi UTR Dashcam
- CVE-2025-29923go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishmentgo-redis · github.com/redis/go-redis +3
- CVE-2025-2556Audi UTR Dashcam Video Stream hard-coded credentialsAudi UTR Dashcam
- CVE-2025-2555Audi Universal Traffic Recorder App FTP Credentials hard-coded passwordAudi Universal Traffic Recorder App
- CVE-2025-29914OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`corazawaf coraza · github.com/jptosso/coraza-waf +3
- CVE-2025-2553D-Link DIR-618/DIR-605L formVirtualServ access controlD-Link DIR-618 · D-Link DIR-605L
- CVE-2025-2552D-Link DIR-618/DIR-605L formTcpipSetup access controlD-Link DIR-618 · D-Link DIR-605L
- CVE-2025-2551D-Link DIR-618/DIR-605L formSetPortTr access controlD-Link DIR-618 · D-Link DIR-605L
- CVE-2024-7598Network restriction bypass via race condition during namespace terminationKubernetes kube-apiserver · k8s.io/kubernetes/cmd/kube-a… +1
- CVE-2025-2550D-Link DIR-618/DIR-605L DDNS Service formSetDDNS access controlD-Link DIR-618 · D-Link DIR-605L
- CVE-2025-2549D-Link DIR-618/DIR-605L formSetPassword access controlD-Link DIR-618 · D-Link DIR-605L
- CVE-2025-2565The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.Liferay Portal · Liferay DXP +2
- CVE-2025-2548D-Link DIR-618/DIR-605L formSetDomainFilter access controlD-Link DIR-618 · D-Link DIR-605L
- CVE-2025-2547D-Link DIR-618/DIR-605L formAdvNetwork access controlD-Link DIR-618 · D-Link DIR-605L
- CVE-2025-2546D-Link DIR-618/DIR-605L Firewall Service formAdvFirewall access controlD-Link DIR-618 · D-Link DIR-605L
- CVE-2025-0254HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226.HCL Software HCL Digital Experience
- CVE-2025-1496Improper Authentication in BG-TEK's Coslat HotspotBG-TEK Coslat Hotspot
- CVE-2025-27888Apache Druid: Server-Side Request Forgery and Cross-Site ScriptingApache Software Foundation Apache Druid · org.apache.druid:…
- CVE-2024-13920Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Functionwebtoffee Order Export & Order Import for WooCommerce
- CVE-2025-1802HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetsdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2024-13922Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Functionwebtoffee Order Export & Order Import for WooCommerce
- CVE-2025-0184Server-Side Request Forgery (SSRF) in langgenius/difylanggenius/dify
- CVE-2024-10457SSRF Vulnerabilities in significant-gravitas/autogptsignificant-gravitas/autogpt
- CVE-2024-12392Server-Side Request Forgery (SSRF) in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2025-0508MD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdkaws/sagemaker-python-sdk · sagemaker
- CVE-2024-12779SSRF in infiniflow/ragflowinfiniflow/ragflow
- CVE-2024-8556Stored XSS in modelscope/agentscopemodelscope/agentscope · agentscope
- CVE-2024-12387Improper Input Validation in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-7767Improper Access Control in danswer-ai/danswerdanswer-ai/danswer
- CVE-2024-12869Improper Authentication in infiniflow/ragflowinfiniflow/ragflow
- CVE-2024-12720Regular Expression Denial of Service (ReDoS) in huggingface/transformershuggingface/transformers · transformers
- CVE-2024-12777Denial of Service in aimhubio/aimaimhubio/aim · aim
- CVE-2024-8021Open Redirect in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2024-8400Stored XSS in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt
- CVE-2024-12074Denial of Service in automatic1111/stable-diffusion-webuiautomatic1111/stable-diffusion-webui
- CVE-2024-8238Unrestricted Code Execution in aimhubio/aimaimhubio/aim · aim
- CVE-2024-12217Path Traversal in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2024-10948Arbitrary File Read via Upload Function in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-9612Unauthorized Access in danswer-ai/danswerdanswer-ai/danswer
- CVE-2024-10721Store XSS in phpipam/phpipamphpipam/phpipam
- CVE-2024-12871Stored Cross-site Scripting (XSS) in infiniflow/ragflowinfiniflow/ragflow
- CVE-2024-12450RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflowinfiniflow/ragflow
- CVE-2025-0453Denial of Service through Batched Queries in GraphQL in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2024-10955ReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-6866Case-Insensitive Path Matching in corydolphin/flask-corscorydolphin/flask-cors · flask-cors
- CVE-2024-8952SSRF in composiohq/composiocomposiohq/composio · composio-core
- CVE-2024-10727Cross-Site Scripting (XSS) in phpipam/phpipamphpipam/phpipam
- CVE-2024-8898Path Traversal in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-11850Stored XSS in langgenius/difylanggenius/dify
- CVE-2024-0640Stored XSS in chatwoot/chatwootchatwoot/chatwoot
- CVE-2024-6844Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-corscorydolphin/flask-cors · flask-cors
- CVE-2024-8057Improper Access Control in danswer-ai/danswerdanswer-ai/danswer
- CVE-2025-0191Denial of Service in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-12870Stored Cross-site Scripting (XSS) in infiniflow/ragflowinfiniflow/ragflow
- CVE-2024-10359Mass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechatdanny-avila/librechat
- CVE-2024-9365Cross-Site Request Forgery (CSRF) in polyaxon/polyaxonpolyaxon/polyaxon
- CVE-2024-6986Cross-site Scripting (XSS) in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-6577Unclaimed S3 Bucket Usage in pytorch/servepytorch/serve · torchserve
- CVE-2024-9308Open Redirect in haotian-liu/llavahaotian-liu/llava
- CVE-2024-11173Unhandled Exception in danny-avila/librechatdanny-avila/librechat
- CVE-2024-12391Regular Expression Denial of Service (ReDoS) in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-11033Denial of Service (DoS) in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-8027Stored Cross-Site Scripting (XSS) in netease-youdao/QAnythingnetease-youdao/qanything
- CVE-2024-6863Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3h2oai/h2o-3 · h2o +1
- CVE-2024-10722Stored Cross-site Scripting (XSS) in phpipam/phpipamphpipam/phpipam
- CVE-2024-10330Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-9617IDOR in danswer-ai/danswerdanswer-ai/danswer
- CVE-2024-8982Local File Inclusion in bentoml/openllmbentoml/openllm
- CVE-2025-0183Stored XSS in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-9311Cross-Site Request Forgery to XSS in haotian-liu/llavahaotian-liu/llava
- CVE-2024-7044Stored XSS in open-webui/open-webuiopen-webui/open-webui · open-webui
- CVE-2024-6583Path Traversal in stangirard/quivrstangirard/quivr
- CVE-2025-0192Stored Cross-site Scripting (XSS) in wandb/openuiwandb/openui
- CVE-2025-1474Weak Password Requirements in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2025-1473CSRF in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2024-10363Improper Access Control in danny-avila/LibreChatdanny-avila/librechat
- CVE-2024-0245Task Hijacking in hamza417/inurehamza417/inure
- CVE-2024-10019Path Traversal and OS Command Injection in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-6841CSRF in vanna-ai/vannavanna-ai/vanna
- CVE-2024-9159Incorrect Authorization in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-9107Stored XSS in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-9447Exposure of Sensitive Information in transformeroptimus/superagitransformeroptimus/superagi
- CVE-2024-9920Unrestricted File Upload and Execution in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-10719Stored Cross-site Scripting (XSS) in phpipam/phpipamphpipam/phpipam
- CVE-2024-10718Cookie without Secure attribute in phpipam/phpipamphpipam/phpipam
- CVE-2024-12388Regular Expression Denial of Service (ReDoS) in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-7035Cross-Site Request Forgery (CSRF) in open-webui/open-webuiopen-webui/open-webui · open-webui
- CVE-2024-12375Local File Inclusion in automatic1111/stable-diffusion-webuiautomatic1111/stable-diffusion-webui
- CVE-2024-11301Improper Enforcement of Unique Constraint in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-7476Broken Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-10908Open Redirect in lm-sys/fastchatlm-sys/fastchat · fschat
- CVE-2024-10707Local File Inclusion in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-9431Improper Privilege Management in transformeroptimus/superagitransformeroptimus/superagi
- CVE-2024-7058Relative Path Traversal in parisneo/lollms-webuiparisneo/lollms
- CVE-2024-6839Improper Regex Path Matching in corydolphin/flask-corscorydolphin/flask-cors · flask-cors
- CVE-2024-6483Arbitrary File/Directory Deletion in aimhubio/aimaimhubio/aim · aim
- CVE-2024-10047Directory Listing Vulnerability in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-11044Open Redirect in automatic1111/stable-diffusion-webuiautomatic1111/stable-diffusion-webui
- CVE-2024-10724Stored XSS in IPV6 Section in phpipam/phpipamphpipam/phpipam
- CVE-2024-8955SSRF in composiohq/composiocomposiohq/composio · composio-core
- CVE-2024-10812Open Redirect in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-10723Stored XSS in phpipam/phpipamphpipam/phpipam
- CVE-2024-12775SSRF in langgenius/difylanggenius/dify
- CVE-2024-8029Stored XSS in imartinez/privategptimartinez/privategpt
- CVE-2024-9418Insufficiently Protected Credentials in transformeroptimus/superagitransformeroptimus/superagi
- CVE-2024-12580Logs Debug Injection in danny-avila/librechatdanny-avila/librechat
- CVE-2024-10725Stored Cross-site Scripting (XSS) in phpipam/phpipamphpipam/phpipam
- CVE-2024-11822Server-Side Request Forgery (SSRF) in langgenius/difylanggenius/dify
- CVE-2024-9900Cross-Site Scripting (XSS) in mudler/localaimudler/localai · github.com/mudler/LocalAI
- CVE-2024-12910Denial of Service in run-llama/llama_indexrun-llama/llama_index · llama-index
- CVE-2024-6838Uncontrolled Resource Consumption in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2025-0188SSRF in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-11824Stored XSS in langgenius/difylanggenius/dify
- CVE-2024-10274Improper Authorization in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-10481Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyuicomfyanonymous/comfyui
- CVE-2024-11821Privilege Escalation in langgenius/difylanggenius/dify
- CVE-2024-11037Path Traversal in binary-husky/gpt_academicbinary-husky/gpt_academic
- CVE-2024-12374Stored XSS in automatic1111/stable-diffusion-webuiautomatic1111/stable-diffusion-webui
- CVE-2024-7771Denial of Service in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-8251Prisma Injection in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-10940Exposure of Sensitive System Information via ImagePromptTemplate in langchain-ai/langchainlangchain-ai/langchain · langchain-core
- CVE-2024-10273Improper Privilege Management in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-11441Stored XSS in Serge in serge-chat/sergeserge-chat/serge
- CVE-2024-13060Improper Authorization in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-54016compression bomb attack in Apache Seata ServerApache Software Foundation Apache Seata · org.apache.seata:…
- CVE-2025-2108140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widgetXpro Addons — 140+ Widgets for Elementor
- CVE-2025-1766Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Updatearraytics Eventin – Event Calendar, Event Registration, Tic…
- CVE-2025-1314Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Functionsmub Custom Twitter Feeds – A Tweets Widget or X Feed Widget
- CVE-2024-48591Inflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting (XSS).
- CVE-2025-29215Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function at /goform/SetNetControlList.
- CVE-2025-29217Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules.
- CVE-2025-29218Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiPwd parameter at /goform/setModules.
- CVE-2025-29410A cross-site scripting (XSS) vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbi
- CVE-2025-29412A cross-site scripting (XSS) vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execu