# CVEs published 2025-03-20

369 CVEs were published on March 20, 2025: 47 critical, 185 high. Days are UTC.

- [CVE-2024-44305](https://cve.now/CVE-2024-44305.md): This issue was addressed by removing the vulnerable code. (CVSS 7.8, Apple macOS)
- [CVE-2024-54564](https://cve.now/CVE-2024-54564.md): This issue was addressed through improved state management. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-44199](https://cve.now/CVE-2024-44199.md): An out-of-bounds read was addressed with improved input validation. (CVSS 7.1, Apple macOS)
- [CVE-2024-54551](https://cve.now/CVE-2024-54551.md): The issue was addressed with improved memory handling. (CVSS 7.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-2574](https://cve.now/CVE-2025-2574.md): Out-of-bounds array write in Xpdf 4.05 due to incorrect integer overflow checking (CVSS 2.1, Xpdf)
- [CVE-2025-2538](https://cve.now/CVE-2025-2538.md): BUG-000174336 (CVSS 9.8, Esri Portal for ArcGIS)
- [CVE-2025-30334](https://cve.now/CVE-2025-30334.md): OpenBSD wg(4) kernel crash (CVSS 6.5, OpenBSD)
- [CVE-2025-29980](https://cve.now/CVE-2025-29980.md): Blind SQL Injection vulnerability in eTRAKiT.Net (CVSS 9.3, CentralSquare eTRAKiT.Net)
- [CVE-2025-2557](https://cve.now/CVE-2025-2557.md): Audi UTR Dashcam Command API access control (CVSS 5.1, Audi UTR Dashcam)
- [CVE-2025-30160](https://cve.now/CVE-2025-30160.md): Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore\_preferences Form (CVSS 8.7, redlib-org redlib · redlib)
- [CVE-2025-29923](https://cve.now/CVE-2025-29923.md): go-redis allows potential out of order responses when \`CLIENT SETINFO\` times out during connection establishment (CVSS 3.7, go-redis · github.com/redis/go-redis +3)
- [CVE-2025-2556](https://cve.now/CVE-2025-2556.md): Audi UTR Dashcam Video Stream hard-coded credentials (CVSS 5.3, Audi UTR Dashcam)
- [CVE-2025-2555](https://cve.now/CVE-2025-2555.md): Audi Universal Traffic Recorder App FTP Credentials hard-coded password (CVSS 2.1, Audi Universal Traffic Recorder App)
- [CVE-2025-29922](https://cve.now/CVE-2025-29922.md): kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace (CVSS 9.6, kcp-dev kcp · github.com/kcp-dev/kcp)
- [CVE-2025-29914](https://cve.now/CVE-2025-29914.md): OWASP Coraza WAF has parser confusion which leads to wrong URI in \`REQUEST\_FILENAME\` (CVSS 5.4, corazawaf coraza · github.com/jptosso/coraza-waf +3)
- [CVE-2025-2553](https://cve.now/CVE-2025-2553.md): D-Link DIR-618/DIR-605L formVirtualServ access control (CVSS 5.3, D-Link DIR-618 · D-Link DIR-605L)
- [CVE-2025-2552](https://cve.now/CVE-2025-2552.md): D-Link DIR-618/DIR-605L formTcpipSetup access control (CVSS 5.3, D-Link DIR-618 · D-Link DIR-605L)
- [CVE-2025-2551](https://cve.now/CVE-2025-2551.md): D-Link DIR-618/DIR-605L formSetPortTr access control (CVSS 5.3, D-Link DIR-618 · D-Link DIR-605L)
- [CVE-2024-7598](https://cve.now/CVE-2024-7598.md): Network restriction bypass via race condition during namespace termination (CVSS 3.1, Kubernetes kube-apiserver · k8s.io/kubernetes/cmd/kube-a… +1)
- [CVE-2025-2480](https://cve.now/CVE-2025-2480.md): Santesoft Sante DICOM Viewer Pro Out-of-bounds Write (CVSS 8.4, Santesoft Sante DICOM Viewer Pro)
- [CVE-2025-2550](https://cve.now/CVE-2025-2550.md): D-Link DIR-618/DIR-605L DDNS Service formSetDDNS access control (CVSS 5.3, D-Link DIR-618 · D-Link DIR-605L)
- [CVE-2025-2549](https://cve.now/CVE-2025-2549.md): D-Link DIR-618/DIR-605L formSetPassword access control (CVSS 5.3, D-Link DIR-618 · D-Link DIR-605L)
- [CVE-2025-2565](https://cve.now/CVE-2025-2565.md): The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1. (CVSS 5.1, Liferay Portal · Liferay DXP +2)
- [CVE-2025-2548](https://cve.now/CVE-2025-2548.md): D-Link DIR-618/DIR-605L formSetDomainFilter access control (CVSS 5.3, D-Link DIR-618 · D-Link DIR-605L)
- [CVE-2025-2547](https://cve.now/CVE-2025-2547.md): D-Link DIR-618/DIR-605L formAdvNetwork access control (CVSS 5.3, D-Link DIR-618 · D-Link DIR-605L)
- [CVE-2025-23120](https://cve.now/CVE-2025-23120.md): A vulnerability allowing remote code execution (RCE) for domain users. (CVSS 9.9, Veeam Backup and Recovery)
- [CVE-2025-2546](https://cve.now/CVE-2025-2546.md): D-Link DIR-618/DIR-605L Firewall Service formAdvFirewall access control (CVSS 5.3, D-Link DIR-618 · D-Link DIR-605L)
- [CVE-2025-0254](https://cve.now/CVE-2025-0254.md): HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. (CVSS 5.9, HCL Software HCL Digital Experience)
- [CVE-2025-1496](https://cve.now/CVE-2025-1496.md): Improper Authentication in BG-TEK's Coslat Hotspot (CVSS 6.5, BG-TEK Coslat Hotspot)
- [GHSA-W466-2WFC-8G58](https://cve.now/GHSA-W466-2WFC-8G58.md): Open WebUI has vulnerable dependency on starlette via fastapi (high (no CVSS), open-webui)
- [CVE-2025-2311](https://cve.now/CVE-2025-2311.md): Authentication Bypass in Sechard Information Technologies' SecHard (CVSS 9.0, Sechard Information Technologies SecHard)
- [CVE-2025-27888](https://cve.now/CVE-2025-27888.md): Apache Druid: Server-Side Request Forgery and Cross-Site Scripting (CVSS 5.8, Apache Software Foundation Apache Druid · org.apache.druid:…)
- [CVE-2024-13920](https://cve.now/CVE-2024-13920.md): Order Export & Order Import for WooCommerce \<= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download\_file Function (CVSS 4.9, webtoffee Order Export & Order Import for WooCommerce)
- [CVE-2024-13921](https://cve.now/CVE-2024-13921.md): Order Export & Order Import for WooCommerce \<= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form\_data Parameter (CVSS 7.2, webtoffee Order Export & Order Import for WooCommerce)
- [CVE-2025-1802](https://cve.now/CVE-2025-1802.md): HT Mega – Absolute Addons For Elementor \<= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2025-2539](https://cve.now/CVE-2025-2539.md): File Away \<= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read (CVSS 7.5, thomstark File Away)
- [CVE-2024-13558](https://cve.now/CVE-2024-13558.md): NP Quote Request for WooCommerce \<= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure (CVSS 7.5, gplsaver NP Quote Request for WooCommerce)
- [CVE-2024-13922](https://cve.now/CVE-2024-13922.md): Order Export & Order Import for WooCommerce \<= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin\_log\_page Function (CVSS 2.7, webtoffee Order Export & Order Import for WooCommerce)
- [CVE-2024-13923](https://cve.now/CVE-2024-13923.md): Order Export & Order Import for WooCommerce \<= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate\_file Function (CVSS 7.6, webtoffee Order Export & Order Import for WooCommerce)
- [CVE-2024-10956](https://cve.now/CVE-2024-10956.md): Cross-Site WebSocket Hijacking in binary-husky/gpt\_academic (CVSS 7.6, binary-husky/gpt\_academic)
- [CVE-2024-12215](https://cve.now/CVE-2024-12215.md): Remote Code Execution in kedro-org/kedro (CVSS 8.8, kedro-org/kedro · kedro)
- [CVE-2024-8613](https://cve.now/CVE-2024-8613.md): Improper Access Control in gaizhenbiao/chuanhuchatgpt (CVSS 8.1, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2025-0184](https://cve.now/CVE-2025-0184.md): Server-Side Request Forgery (SSRF) in langgenius/dify (CVSS 6.5, langgenius/dify)
- [CVE-2024-9216](https://cve.now/CVE-2024-9216.md): Authentication Bypass in gaizhenbiao/ChuanhuChatGPT (CVSS 8.1, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-10457](https://cve.now/CVE-2024-10457.md): SSRF Vulnerabilities in significant-gravitas/autogpt (CVSS 6.5, significant-gravitas/autogpt)
- [CVE-2024-12392](https://cve.now/CVE-2024-12392.md): Server-Side Request Forgery (SSRF) in binary-husky/gpt\_academic (CVSS 6.5, binary-husky/gpt\_academic)
- [CVE-2024-6825](https://cve.now/CVE-2024-6825.md): Remote Code Execution in BerriAI/litellm (CVSS 8.8, berriai/litellm · litellm)
- [CVE-2024-7764](https://cve.now/CVE-2024-7764.md): SQL Injection in vanna-ai/vanna (CVSS 8.1, vanna-ai/vanna)
- [CVE-2024-8196](https://cve.now/CVE-2024-8196.md): Missing Authentication for Critical Function in mintplex-labs/anything-llm (CVSS 9.8, mintplex-labs/anything-llm)
- [CVE-2024-12063](https://cve.now/CVE-2024-12063.md): Denial of Service in imartinez/privategpt (CVSS 7.5, imartinez/privategpt)
- [CVE-2024-10549](https://cve.now/CVE-2024-10549.md): Denial of Service by ReDOS in h2oai/h2o-3 (CVSS 7.5, h2oai/h2o-3 · h2o +1)
- [CVE-2024-8248](https://cve.now/CVE-2024-8248.md): Path Traversal in mintplex-labs/anything-llm (CVSS 7.2, mintplex-labs/anything-llm)
- [CVE-2024-12866](https://cve.now/CVE-2024-12866.md): Local File Inclusion in netease-youdao/qanything (CVSS 7.5, netease-youdao/qanything)
- [CVE-2024-8017](https://cve.now/CVE-2024-8017.md): Cross-site Scripting (XSS) in open-webui/open-webui (CVSS 9.0, open-webui/open-webui)
- [CVE-2025-0508](https://cve.now/CVE-2025-0508.md): MD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdk (CVSS 5.9, aws/sagemaker-python-sdk · sagemaker)
- [CVE-2025-0454](https://cve.now/CVE-2025-0454.md): SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt (CVSS 7.5, significant-gravitas/autogpt)
- [CVE-2024-8101](https://cve.now/CVE-2024-8101.md): Stored XSS in aimhubio/aim (CVSS 7.2, aimhubio/aim)
- [CVE-2024-10650](https://cve.now/CVE-2024-10650.md): Denial of Service (DoS) in gaizhenbiao/chuanhuchatgpt (CVSS 7.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-12779](https://cve.now/CVE-2024-12779.md): SSRF in infiniflow/ragflow (CVSS 6.5, infiniflow/ragflow)
- [CVE-2024-12048](https://cve.now/CVE-2024-12048.md): IDOR Vulnerability in transformeroptimus/superagi (CVSS 8.8, transformeroptimus/superagi)
- [CVE-2024-8487](https://cve.now/CVE-2024-8487.md): CORS Vulnerability in modelscope/agentscope (CVSS 7.4, modelscope/agentscope · agentscope)
- [CVE-2024-8769](https://cve.now/CVE-2024-8769.md): Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim (CVSS 9.1, aimhubio/aim · aim)
- [CVE-2024-8556](https://cve.now/CVE-2024-8556.md): Stored XSS in modelscope/agentscope (CVSS 6.1, modelscope/agentscope · agentscope)
- [CVE-2024-12387](https://cve.now/CVE-2024-12387.md): Improper Input Validation in binary-husky/gpt\_academic (CVSS 6.5, binary-husky/gpt\_academic)
- [CVE-2024-12766](https://cve.now/CVE-2024-12766.md): SSRF in parisneo/lollms-webui (CVSS 7.5, parisneo/lollms-webui)
- [CVE-2024-7767](https://cve.now/CVE-2024-7767.md): Improper Access Control in danswer-ai/danswer (CVSS 6.5, danswer-ai/danswer)
- [CVE-2024-12869](https://cve.now/CVE-2024-12869.md): Improper Authentication in infiniflow/ragflow (CVSS 4.3, infiniflow/ragflow)
- [CVE-2024-11300](https://cve.now/CVE-2024-11300.md): Improper Access Control in lunary-ai/lunary (CVSS 8.8, lunary-ai/lunary)
- [CVE-2024-10830](https://cve.now/CVE-2024-10830.md): Path Traversal in eosphoros-ai/db-gpt (CVSS 8.2, eosphoros-ai/db-gpt · dbgpt)
- [CVE-2024-8524](https://cve.now/CVE-2024-8524.md): Directory Traversal in modelscope/agentscope (CVSS 7.5, modelscope/agentscope · agentscope)
- [CVE-2024-5752](https://cve.now/CVE-2024-5752.md): Path Traversal in stitionai/devika (CVSS 9.1, stitionai/devika)
- [CVE-2024-8736](https://cve.now/CVE-2024-8736.md): Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui (CVSS 7.1, parisneo/lollms-webui)
- [CVE-2024-12070](https://cve.now/CVE-2024-12070.md): Denial of Service in haotian-liu/llava (CVSS 7.5, haotian-liu/llava)
- [CVE-2024-8958](https://cve.now/CVE-2024-8958.md): Unrestricted File Write and Read in composiohq/composio (CVSS 7.2, composiohq/composio)
- [CVE-2024-11030](https://cve.now/CVE-2024-11030.md): SSRF in binary-husky/gpt\_academic (CVSS 7.7, binary-husky/gpt\_academic)
- [CVE-2024-12720](https://cve.now/CVE-2024-12720.md): Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3, huggingface/transformers · transformers)
- [CVE-2024-12777](https://cve.now/CVE-2024-12777.md): Denial of Service in aimhubio/aim (CVSS 5.9, aimhubio/aim · aim)
- [CVE-2024-4990](https://cve.now/CVE-2024-4990.md): Unsafe Reflection in base Component class in yiisoft/yii2 (CVSS 8.1, yiisoft/yii2)
- [CVE-2024-11043](https://cve.now/CVE-2024-11043.md): Denial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeai (CVSS 7.5, invoke-ai/invokeai · invokeai)
- [CVE-2024-8053](https://cve.now/CVE-2024-8053.md): Improper Authentication in open-webui/open-webui (CVSS 7.5, open-webui/open-webui · open-webui)
- [CVE-2024-8021](https://cve.now/CVE-2024-8021.md): Open Redirect in gradio-app/gradio (CVSS 5.4, gradio-app/gradio · gradio)
- [CVE-2024-8400](https://cve.now/CVE-2024-8400.md): Stored XSS in gaizhenbiao/chuanhuchatgpt (CVSS 5.4, gaizhenbiao/chuanhuchatgpt)
- [CVE-2024-10648](https://cve.now/CVE-2024-10648.md): Path Traversal in gradio-app/gradio (CVSS 8.2, gradio-app/gradio · gradio)
- [CVE-2024-8183](https://cve.now/CVE-2024-8183.md): CORS Misconfiguration in prefecthq/prefect (CVSS 7.6, prefecthq/prefect · prefect)
- [CVE-2024-12074](https://cve.now/CVE-2024-12074.md): Denial of Service in automatic1111/stable-diffusion-webui (CVSS 6.5, automatic1111/stable-diffusion-webui)
- [CVE-2024-8238](https://cve.now/CVE-2024-8238.md): Unrestricted Code Execution in aimhubio/aim (CVSS 5.9, aimhubio/aim · aim)
- [CVE-2024-12217](https://cve.now/CVE-2024-12217.md): Path Traversal in gradio-app/gradio (CVSS 5.3, gradio-app/gradio · gradio)
- [CVE-2024-10948](https://cve.now/CVE-2024-10948.md): Arbitrary File Read via Upload Function in binary-husky/gpt\_academic (CVSS 6.5, binary-husky/gpt\_academic)
- [CVE-2024-9612](https://cve.now/CVE-2024-9612.md): Unauthorized Access in danswer-ai/danswer (CVSS 6.5, danswer-ai/danswer)
- [CVE-2024-10721](https://cve.now/CVE-2024-10721.md): Store XSS in phpipam/phpipam (CVSS 3.5, phpipam/phpipam)
- [CVE-2024-12871](https://cve.now/CVE-2024-12871.md): Stored Cross-site Scripting (XSS) in infiniflow/ragflow (CVSS 5.4, infiniflow/ragflow)
- [CVE-2024-10272](https://cve.now/CVE-2024-10272.md): Broken Access Control in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2025-1040](https://cve.now/CVE-2025-1040.md): Server-Side Template Injection (SSTI) in significant-gravitas/autogpt (CVSS 8.8, significant-gravitas/autogpt)
- [CVE-2024-12450](https://cve.now/CVE-2024-12450.md): RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow (CVSS 6.5, infiniflow/ragflow)
- [CVE-2024-8062](https://cve.now/CVE-2024-8062.md): Denial of Service in h2oai/h2o-3 (CVSS 7.5, h2oai/h2o-3 · h2o +1)
- [CVE-2024-8998](https://cve.now/CVE-2024-8998.md): Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-8026](https://cve.now/CVE-2024-8026.md): CSRF due to overly permissive CORS headers in netease-youdao/qanything (CVSS 8.1, netease-youdao/qanything)
- [CVE-2024-8966](https://cve.now/CVE-2024-8966.md): Denial of Service in gradio-app/gradio (CVSS 7.5, gradio-app/gradio · gradio)
- [CVE-2025-0453](https://cve.now/CVE-2025-0453.md): Denial of Service through Batched Queries in GraphQL in mlflow/mlflow (CVSS 5.9, mlflow/mlflow · mlflow)
- [CVE-2024-10834](https://cve.now/CVE-2024-10834.md): Arbitrary File Write in eosphoros-ai/db-gpt (CVSS 9.1, eosphoros-ai/db-gpt)
- [CVE-2024-10955](https://cve.now/CVE-2024-10955.md): ReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgpt (CVSS 6.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-8537](https://cve.now/CVE-2024-8537.md): Path Traversal in modelscope/agentscope (CVSS 9.1, modelscope/agentscope · agentscope)
- [CVE-2024-10912](https://cve.now/CVE-2024-10912.md): Denial of Service in lm-sys/fastchat (CVSS 7.5, lm-sys/fastchat · fschat)
- [CVE-2024-6866](https://cve.now/CVE-2024-6866.md): Case-Insensitive Path Matching in corydolphin/flask-cors (CVSS 5.3, corydolphin/flask-cors · flask-cors)
- [CVE-2024-8952](https://cve.now/CVE-2024-8952.md): SSRF in composiohq/composio (CVSS 6.8, composiohq/composio · composio-core)
- [CVE-2024-7776](https://cve.now/CVE-2024-7776.md): Arbitrary File Overwrite in onnx/onnx (CVSS 8.1, onnx/onnx · onnx)
- [CVE-2024-10727](https://cve.now/CVE-2024-10727.md): Cross-Site Scripting (XSS) in phpipam/phpipam (CVSS 3.5, phpipam/phpipam)
- [CVE-2024-8898](https://cve.now/CVE-2024-8898.md): Path Traversal in parisneo/lollms-webui (CVSS 6.7, parisneo/lollms-webui)
- [CVE-2024-10569](https://cve.now/CVE-2024-10569.md): Zip Bomb Vulnerability in gradio-app/gradio (CVSS 7.5, gradio-app/gradio · gradio)
- [CVE-2024-8953](https://cve.now/CVE-2024-8953.md): Unsafe eval usage in composiohq/composio (CVSS 7.2, composiohq/composio · composio-core)
- [CVE-2024-8063](https://cve.now/CVE-2024-8063.md): Divide by Zero in ollama/ollama (CVSS 7.5, ollama/ollama · github.com/ollama/ollama)
- [CVE-2024-11850](https://cve.now/CVE-2024-11850.md): Stored XSS in langgenius/dify (CVSS 6.8, langgenius/dify)
- [CVE-2024-10986](https://cve.now/CVE-2024-10986.md): Local File Read (LFI) by Tarslip Symlink via arxiv\_download() API in binary-husky/gpt\_academic (CVSS 8.8, binary-husky/gpt\_academic)
- [CVE-2025-0189](https://cve.now/CVE-2025-0189.md): Denial of Service in aimhubio/aim (CVSS 7.5, aimhubio/aim · aim)
- [CVE-2024-11602](https://cve.now/CVE-2024-11602.md): CORS Vulnerability in feast-dev/feast (CVSS 7.4, feast-dev/feast · feast)
- [CVE-2025-0312](https://cve.now/CVE-2025-0312.md): NULL Pointer Dereference in ollama/ollama (CVSS 7.5, ollama/ollama · github.com/ollama/ollama)
- [CVE-2024-10051](https://cve.now/CVE-2024-10051.md): Unauthenticated Denial of Service in shaunwei/realchar (CVSS 7.5, shaunwei/realchar)
- [CVE-2024-0640](https://cve.now/CVE-2024-0640.md): Stored XSS in chatwoot/chatwoot (CVSS 5.6, chatwoot/chatwoot)
- [CVE-2024-6844](https://cve.now/CVE-2024-6844.md): Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors (CVSS 5.3, corydolphin/flask-cors · flask-cors)
- [CVE-2024-6829](https://cve.now/CVE-2024-6829.md): Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim (CVSS 9.1, aimhubio/aim · aim)
- [CVE-2025-1451](https://cve.now/CVE-2025-1451.md): Insufficient Patch Leading to DoS in parisneo/lollms-webui (CVSS 7.5, parisneo/lollms-webui)
- [CVE-2024-7768](https://cve.now/CVE-2024-7768.md): Denial of Service in h2oai/h2o-3 (CVSS 7.5, h2oai/h2o-3 · h2o +1)
- [CVE-2024-10188](https://cve.now/CVE-2024-10188.md): Denial of Service in BerriAI/litellm (CVSS 7.5, berriai/litellm · litellm)
- [CVE-2024-12864](https://cve.now/CVE-2024-12864.md): Unauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanything (CVSS 7.5, netease-youdao/qanything)
- [CVE-2024-8057](https://cve.now/CVE-2024-8057.md): Improper Access Control in danswer-ai/danswer (CVSS 4.3, danswer-ai/danswer)
- [CVE-2024-10954](https://cve.now/CVE-2024-10954.md): Prompt Injection Leading to RCE in binary-husky/gpt\_academic Plugin \`manim\` (CVSS 8.8, binary-husky/gpt\_academic)
- [CVE-2024-11958](https://cve.now/CVE-2024-11958.md): SQL Injection in run-llama/llama\_index (CVSS 9.8, run-llama/llama\_index · llama-index-retrievers-duckdb-retri…)
- [CVE-2025-0191](https://cve.now/CVE-2025-0191.md): Denial of Service in gaizhenbiao/chuanhuchatgpt (CVSS 6.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2025-0628](https://cve.now/CVE-2025-0628.md): Improper Authorization in BerriAI/litellm (CVSS 8.1, berriai/litellm · litellm)
- [CVE-2024-12870](https://cve.now/CVE-2024-12870.md): Stored Cross-site Scripting (XSS) in infiniflow/ragflow (CVSS 5.4, infiniflow/ragflow)
- [CVE-2025-0281](https://cve.now/CVE-2025-0281.md): Stored Cross-Site Scripting (XSS) in lunary-ai/lunary (CVSS 7.3, lunary-ai/lunary)
- [CVE-2024-10359](https://cve.now/CVE-2024-10359.md): Mass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechat (CVSS 4.6, danny-avila/librechat)
- [CVE-2024-9365](https://cve.now/CVE-2024-9365.md): Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon (CVSS 6.5, polyaxon/polyaxon)
- [CVE-2024-12389](https://cve.now/CVE-2024-12389.md): Path Traversal in binary-husky/gpt\_academic (CVSS 8.8, binary-husky/gpt\_academic)
- [CVE-2024-10624](https://cve.now/CVE-2024-10624.md): Regular Expression Denial of Service (ReDoS) in gradio-app/gradio (CVSS 7.5, gradio-app/gradio · gradio)
- [CVE-2025-0187](https://cve.now/CVE-2025-0187.md): Denial of Service (DoS) by Sending Large Filename at File Upload Endpoint in gradio-app/gradio (CVSS 7.5, gradio-app/gradio)
- [CVE-2024-12776](https://cve.now/CVE-2024-12776.md): Authentication Bypass in langgenius/dify (CVSS 8.1, langgenius/dify)
- [CVE-2024-9229](https://cve.now/CVE-2024-9229.md): Denial of Service (DoS) via Multipart Boundary in stangirard/quivr (CVSS 7.5, stangirard/quivr · quivr-core)
- [CVE-2024-10252](https://cve.now/CVE-2024-10252.md): Code Injection in langgenius/dify (CVSS 8.8, langgenius/dify)
- [CVE-2024-6986](https://cve.now/CVE-2024-6986.md): Cross-site Scripting (XSS) in parisneo/lollms-webui (CVSS 5.5, parisneo/lollms-webui)
- [CVE-2024-9437](https://cve.now/CVE-2024-9437.md): Unauthenticated Denial of Service in transformeroptimus/superagi (CVSS 7.5, transformeroptimus/superagi)
- [CVE-2024-7043](https://cve.now/CVE-2024-7043.md): Improper Access Control in open-webui/open-webui (CVSS 8.1, open-webui/open-webui · open-webui)
- [CVE-2024-11041](https://cve.now/CVE-2024-11041.md): Remote Code Execution in vllm-project/vllm (CVSS 9.8, vllm-project/vllm · vllm)
- [CVE-2024-9099](https://cve.now/CVE-2024-9099.md): Exposure of Private API Keys in lunary-ai/lunary (CVSS 8.8, lunary-ai/lunary)
- [CVE-2024-8765](https://cve.now/CVE-2024-8765.md): Improper Path Equivalence Resolution in lunary-ai/lunary (CVSS 7.3, lunary-ai/lunary)
- [CVE-2024-6577](https://cve.now/CVE-2024-6577.md): Unclaimed S3 Bucket Usage in pytorch/serve (CVSS 6.3, pytorch/serve · torchserve)
- [CVE-2024-10950](https://cve.now/CVE-2024-10950.md): Code Injection in binary-husky/gpt\_academic (CVSS 8.8, binary-husky/gpt\_academic)
- [CVE-2024-9308](https://cve.now/CVE-2024-9308.md): Open Redirect in haotian-liu/llava (CVSS 6.1, haotian-liu/llava)
- [CVE-2024-12390](https://cve.now/CVE-2024-12390.md): Remote Code Execution in binary-husky/gpt\_academic (CVSS 8.8, binary-husky/gpt\_academic)
- [CVE-2024-7983](https://cve.now/CVE-2024-7983.md): Denial of Service in open-webui/open-webui (CVSS 7.5, open-webui/open-webui · open-webui)
- [CVE-2024-10714](https://cve.now/CVE-2024-10714.md): Denial of Service in binary-husky/gpt\_academic (CVSS 7.5, binary-husky/gpt\_academic)
- [CVE-2024-9439](https://cve.now/CVE-2024-9439.md): Remote Code Execution in transformeroptimus/superagi (CVSS 8.8, transformeroptimus/superagi)
- [CVE-2024-11173](https://cve.now/CVE-2024-11173.md): Unhandled Exception in danny-avila/librechat (CVSS 6.5, danny-avila/librechat)
- [CVE-2024-12391](https://cve.now/CVE-2024-12391.md): Regular Expression Denial of Service (ReDoS) in binary-husky/gpt\_academic (CVSS 6.5, binary-husky/gpt\_academic)
- [CVE-2024-10720](https://cve.now/CVE-2024-10720.md): Stored Cross-site Scripting (XSS) in phpipam/phpipam (CVSS 8.2, phpipam/phpipam)
- [CVE-2024-6982](https://cve.now/CVE-2024-6982.md): Remote Code Execution in Calculate Function in parisneo/lollms (CVSS 8.4, parisneo/lollms · lollms)
- [CVE-2024-8018](https://cve.now/CVE-2024-8018.md): Denial of Service (DOS) in imartinez/privategpt (CVSS 7.5, imartinez/privategpt)
- [CVE-2024-12882](https://cve.now/CVE-2024-12882.md): SSRF in comfyanonymous/comfyui (CVSS 7.5, comfyanonymous/comfyui)
- [CVE-2024-11033](https://cve.now/CVE-2024-11033.md): Denial of Service (DoS) in binary-husky/gpt\_academic (CVSS 6.5, binary-husky/gpt\_academic)
- [CVE-2024-8027](https://cve.now/CVE-2024-8027.md): Stored Cross-Site Scripting (XSS) in netease-youdao/QAnything (CVSS 6.1, netease-youdao/qanything)
- [CVE-2024-6863](https://cve.now/CVE-2024-6863.md): Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3 (CVSS 6.5, h2oai/h2o-3 · h2o +1)
- [CVE-2024-10722](https://cve.now/CVE-2024-10722.md): Stored Cross-site Scripting (XSS) in phpipam/phpipam (CVSS 3.5, phpipam/phpipam)
- [CVE-2024-12376](https://cve.now/CVE-2024-12376.md): Server Side Request Forgery in lm-sys/fastchat (CVSS 7.5, lm-sys/fastchat · fschat)
- [CVE-2024-10330](https://cve.now/CVE-2024-10330.md): Improper Access Control in lunary-ai/lunary (CVSS 6.5, lunary-ai/lunary)
- [CVE-2024-8789](https://cve.now/CVE-2024-8789.md): Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-12886](https://cve.now/CVE-2024-12886.md): Out-Of-Memory (OOM) Vulnerability in ollama/ollama (CVSS 7.5, ollama/ollama · github.com/ollama/ollama)
- [CVE-2024-6842](https://cve.now/CVE-2024-6842.md): Exposure of Sensitive Information in mintplex-labs/anything-llm (CVSS 7.5, mintplex-labs/anything-llm)
- [CVE-2024-10819](https://cve.now/CVE-2024-10819.md): CSRF to XSS in binary-husky/gpt\_academic (CVSS 7.1, binary-husky/gpt\_academic)
- [CVE-2024-9617](https://cve.now/CVE-2024-9617.md): IDOR in danswer-ai/danswer (CVSS 6.5, danswer-ai/danswer)
- [CVE-2024-8982](https://cve.now/CVE-2024-8982.md): Local File Inclusion in bentoml/openllm (CVSS 6.2, bentoml/openllm)
- [CVE-2025-0183](https://cve.now/CVE-2025-0183.md): Stored XSS in binary-husky/gpt\_academic (CVSS 5.4, binary-husky/gpt\_academic)
- [CVE-2024-9311](https://cve.now/CVE-2024-9311.md): Cross-Site Request Forgery to XSS in haotian-liu/llava (CVSS 6.1, haotian-liu/llava)
- [CVE-2024-7044](https://cve.now/CVE-2024-7044.md): Stored XSS in open-webui/open-webui (CVSS 6.8, open-webui/open-webui · open-webui)
- [CVE-2024-6583](https://cve.now/CVE-2024-6583.md): Path Traversal in stangirard/quivr (CVSS 4.3, stangirard/quivr)
- [CVE-2025-0192](https://cve.now/CVE-2025-0192.md): Stored Cross-site Scripting (XSS) in wandb/openui (CVSS 5.4, wandb/openui)
- [CVE-2024-7957](https://cve.now/CVE-2024-7957.md): Arbitrary File Overwrite in danswer-ai/danswer (CVSS 9.1, danswer-ai/danswer)
- [CVE-2024-8551](https://cve.now/CVE-2024-8551.md): Path Traversal in modelscope/agentscope (CVSS 9.1, modelscope/agentscope · agentscope)
- [CVE-2025-1474](https://cve.now/CVE-2025-1474.md): Weak Password Requirements in mlflow/mlflow (CVSS 3.8, mlflow/mlflow · mlflow)
- [CVE-2025-1473](https://cve.now/CVE-2025-1473.md): CSRF in mlflow/mlflow (CVSS 5.4, mlflow/mlflow · mlflow)
- [CVE-2024-8616](https://cve.now/CVE-2024-8616.md): Arbitrary File Overwrite in h2oai/h2o-3 (CVSS 8.2, h2oai/h2o-3 · h2o +1)
- [CVE-2024-8055](https://cve.now/CVE-2024-8055.md): Local File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vanna (CVSS 7.5, vanna-ai/vanna)
- [CVE-2024-10363](https://cve.now/CVE-2024-10363.md): Improper Access Control in danny-avila/LibreChat (CVSS 5.4, danny-avila/librechat)
- [CVE-2024-11171](https://cve.now/CVE-2024-11171.md): Improper Input Validation in danny-avila/librechat (CVSS 7.5, danny-avila/librechat)
- [CVE-2024-0245](https://cve.now/CVE-2024-0245.md): Task Hijacking in hamza417/inure (CVSS 5.5, hamza417/inure)
- [CVE-2024-10833](https://cve.now/CVE-2024-10833.md): Arbitrary File Write in eosphoros-ai/db-gpt (CVSS 9.1, eosphoros-ai/db-gpt · dbgpt)
- [CVE-2024-8954](https://cve.now/CVE-2024-8954.md): Authentication Bypass in composiohq/composio (CVSS 9.8, composiohq/composio)
- [CVE-2024-10019](https://cve.now/CVE-2024-10019.md): Path Traversal and OS Command Injection in parisneo/lollms-webui (CVSS 6.3, parisneo/lollms-webui)
- [CVE-2024-9070](https://cve.now/CVE-2024-9070.md): Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml (CVSS 9.8, bentoml/bentoml · bentoml)
- [CVE-2024-6841](https://cve.now/CVE-2024-6841.md): CSRF in vanna-ai/vanna (CVSS 6.5, vanna-ai/vanna)
- [CVE-2024-10907](https://cve.now/CVE-2024-10907.md): Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchat (CVSS 7.5, lm-sys/fastchat · fschat)
- [CVE-2024-9159](https://cve.now/CVE-2024-9159.md): Incorrect Authorization in gaizhenbiao/chuanhuchatgpt (CVSS 6.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-9107](https://cve.now/CVE-2024-9107.md): Stored XSS in gaizhenbiao/chuanhuchatgpt (CVSS 6.8, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-11045](https://cve.now/CVE-2024-11045.md): Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui (CVSS 9.6, automatic1111/stable-diffusion-webui)
- [CVE-2024-9056](https://cve.now/CVE-2024-9056.md): Denial of Service in bentoml/bentoml (CVSS 7.5, bentoml/bentoml · bentoml)
- [CVE-2024-10550](https://cve.now/CVE-2024-10550.md): Denial of Service by ReDOS in h2oai/h2o-3 (CVSS 7.5, h2oai/h2o-3 · h2o +1)
- [CVE-2024-9447](https://cve.now/CVE-2024-9447.md): Exposure of Sensitive Information in transformeroptimus/superagi (CVSS 6.5, transformeroptimus/superagi)
- [CVE-2024-12778](https://cve.now/CVE-2024-12778.md): Denial of Service in aimhubio/aim (CVSS 7.5, aimhubio/aim · aim)
- [CVE-2024-8061](https://cve.now/CVE-2024-8061.md): Denial of Service in aimhubio/aim (CVSS 7.5, aimhubio/aim · aim)
- [CVE-2024-8024](https://cve.now/CVE-2024-8024.md): CORS Misconfiguration in netease-youdao/qanything (CVSS 7.5, netease-youdao/qanything)
- [CVE-2024-12433](https://cve.now/CVE-2024-12433.md): Remote Code Execution in infiniflow/ragflow (CVSS 9.8, infiniflow/ragflow)
- [CVE-2024-9920](https://cve.now/CVE-2024-9920.md): Unrestricted File Upload and Execution in parisneo/lollms-webui (CVSS 6.6, parisneo/lollms-webui)
- [CVE-2024-10719](https://cve.now/CVE-2024-10719.md): Stored Cross-site Scripting (XSS) in phpipam/phpipam (CVSS 2.4, phpipam/phpipam)
- [CVE-2024-10718](https://cve.now/CVE-2024-10718.md): Cookie without Secure attribute in phpipam/phpipam (CVSS 5.3, phpipam/phpipam)
- [CVE-2024-11172](https://cve.now/CVE-2024-11172.md): Denial of Service in danny-avila/librechat (CVSS 7.5, danny-avila/librechat)
- [CVE-2024-12388](https://cve.now/CVE-2024-12388.md): Regular Expression Denial of Service (ReDoS) in binary-husky/gpt\_academic (CVSS 6.5, binary-husky/gpt\_academic)
- [CVE-2024-9701](https://cve.now/CVE-2024-9701.md): Remote Code Execution in kedro-org/kedro (CVSS 9.8, kedro-org/kedro · kedro)
- [CVE-2024-10906](https://cve.now/CVE-2024-10906.md): Cross-Site Request Forgery (CSRF) in eosphoros-ai/db-gpt (CVSS 7.1, eosphoros-ai/db-gpt · dbgpt)
- [CVE-2024-8065](https://cve.now/CVE-2024-8065.md): CSRF in danswer-ai/danswer (CVSS 8.1, danswer-ai/danswer)
- [CVE-2024-10264](https://cve.now/CVE-2024-10264.md): HTTP Request Smuggling in netease-youdao/qanything (CVSS 7.5, netease-youdao/qanything)
- [CVE-2024-7035](https://cve.now/CVE-2024-7035.md): Cross-Site Request Forgery (CSRF) in open-webui/open-webui (CVSS 6.9, open-webui/open-webui · open-webui)
- [CVE-2024-12044](https://cve.now/CVE-2024-12044.md): Remote Code Execution by Pickle Deserialization in open-mmlab/mmdetection (CVSS 9.8, open-mmlab/mmdetection)
- [CVE-2024-12375](https://cve.now/CVE-2024-12375.md): Local File Inclusion in automatic1111/stable-diffusion-webui (CVSS 6.5, automatic1111/stable-diffusion-webui)
- [CVE-2025-0317](https://cve.now/CVE-2025-0317.md): Divide By Zero in ollama/ollama (CVSS 7.5, ollama/ollama · github.com/ollama/ollama)
- [CVE-2024-11603](https://cve.now/CVE-2024-11603.md): Server-Side Request Forgery in lm-sys/fastchat (CVSS 7.5, lm-sys/fastchat · fschat)
- [CVE-2025-0182](https://cve.now/CVE-2025-0182.md): Denial of Service in danswer-ai/danswer (CVSS 7.5, danswer-ai/danswer)
- [CVE-2024-11301](https://cve.now/CVE-2024-11301.md): Improper Enforcement of Unique Constraint in lunary-ai/lunary (CVSS 6.5, lunary-ai/lunary)
- [CVE-2024-7476](https://cve.now/CVE-2024-7476.md): Broken Access Control in lunary-ai/lunary (CVSS 4.3, lunary-ai/lunary)
- [CVE-2024-11169](https://cve.now/CVE-2024-11169.md): Unhandled Exception Leading to Server Crash in danny-avila/librechat (CVSS 7.5, danny-avila/librechat)
- [CVE-2024-11039](https://cve.now/CVE-2024-11039.md): Deserialization of Untrusted Data in binary-husky/gpt\_academic (CVSS 8.8, binary-husky/gpt\_academic)
- [CVE-2024-10908](https://cve.now/CVE-2024-10908.md): Open Redirect in lm-sys/fastchat (CVSS 6.1, lm-sys/fastchat · fschat)
- [CVE-2024-6854](https://cve.now/CVE-2024-6854.md): Arbitrary File Overwrite in h2oai/h2o-3 (CVSS 7.1, h2oai/h2o-3 · h2o +1)
- [CVE-2024-10707](https://cve.now/CVE-2024-10707.md): Local File Inclusion in gaizhenbiao/chuanhuchatgpt (CVSS 6.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-9919](https://cve.now/CVE-2024-9919.md): Missing Authentication Check in parisneo/lollms-webui (CVSS 8.4, parisneo/lollms-webui)
- [CVE-2024-6827](https://cve.now/CVE-2024-6827.md): HTTP Request Smuggling in benoitc/gunicorn (CVSS 7.5, benoitc/gunicorn · gunicorn)
- [CVE-2024-6851](https://cve.now/CVE-2024-6851.md): Arbitrary File Deletion in aimhubio/aim (CVSS 7.5, aimhubio/aim · aim)
- [CVE-2024-4023](https://cve.now/CVE-2024-4023.md): Stored XSS in flatpressblog/flatpress (CVSS 8.1, flatpressblog/flatpress)
- [CVE-2024-8859](https://cve.now/CVE-2024-8859.md): Path Traversal in mlflow/mlflow (CVSS 7.5, mlflow/mlflow · mlflow)
- [CVE-2024-10190](https://cve.now/CVE-2024-10190.md): Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod (CVSS 9.8, horovod/horovod · horovod)
- [CVE-2024-8028](https://cve.now/CVE-2024-8028.md): Denial of Service in danswer-ai/danswer (CVSS 7.5, danswer-ai/danswer)
- [CVE-2024-10935](https://cve.now/CVE-2024-10935.md): Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui (CVSS 7.5, automatic1111/stable-diffusion-webui)
- [CVE-2024-10513](https://cve.now/CVE-2024-10513.md): Path Traversal in mintplex-labs/anything-llm (CVSS 7.2, mintplex-labs/anything-llm)
- [CVE-2024-10829](https://cve.now/CVE-2024-10829.md): Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpt (CVSS 7.5, eosphoros-ai/db-gpt · dbgpt)
- [CVE-2024-8438](https://cve.now/CVE-2024-8438.md): Path Traversal in modelscope/agentscope (CVSS 7.5, modelscope/agentscope · agentscope)
- [CVE-2024-12065](https://cve.now/CVE-2024-12065.md): Local File Inclusion in haotian-liu/llava (CVSS 7.5, haotian-liu/llava)
- [CVE-2024-11167](https://cve.now/CVE-2024-11167.md): Improper Access Control in danny-avila/librechat (CVSS 9.4, danny-avila/librechat)
- [CVE-2025-0315](https://cve.now/CVE-2025-0315.md): Allocation of Resources Without Limits or Throttling in ollama/ollama (CVSS 7.5, ollama/ollama · github.com/ollama/ollama)
- [CVE-2024-9362](https://cve.now/CVE-2024-9362.md): Directory Traversal in polyaxon/polyaxon (CVSS 7.5, polyaxon/polyaxon)
- [CVE-2024-8099](https://cve.now/CVE-2024-8099.md): Server-Side Request Forgery (SSRF) in vanna-ai/vanna (CVSS 8.3, vanna-ai/vanna)
- [CVE-2024-9699](https://cve.now/CVE-2024-9699.md): Cross-Site Scripting (XSS) in flatpressblog/flatpress (CVSS 7.5, flatpressblog/flatpress)
- [CVE-2024-9431](https://cve.now/CVE-2024-9431.md): Improper Privilege Management in transformeroptimus/superagi (CVSS 6.5, transformeroptimus/superagi)
- [CVE-2024-7058](https://cve.now/CVE-2024-7058.md): Relative Path Traversal in parisneo/lollms-webui (CVSS 4.4, parisneo/lollms)
- [CVE-2024-12911](https://cve.now/CVE-2024-12911.md): SQL Injection in run-llama/llama\_index (CVSS 7.1, run-llama/llama\_index · llama-index)
- [CVE-2024-10267](https://cve.now/CVE-2024-10267.md): Information Disclosure in transformeroptimus/superagi (CVSS 7.5, transformeroptimus/superagi)
- [CVE-2024-9309](https://cve.now/CVE-2024-9309.md): SSRF in POST /worker\_generate\_stream API endpoint in haotian-liu/llava (CVSS 9.3, haotian-liu/llava)
- [CVE-2024-6839](https://cve.now/CVE-2024-6839.md): Improper Regex Path Matching in corydolphin/flask-cors (CVSS 4.3, corydolphin/flask-cors · flask-cors)
- [CVE-2024-9096](https://cve.now/CVE-2024-9096.md): Improper Authorization in lunary-ai/lunary (CVSS 7.6, lunary-ai/lunary)
- [CVE-2024-8249](https://cve.now/CVE-2024-8249.md): Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm (CVSS 7.5, mintplex-labs/anything-llm)
- [CVE-2024-10901](https://cve.now/CVE-2024-10901.md): Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt (CVSS 9.1, eosphoros-ai/db-gpt · dbgpt)
- [CVE-2024-9098](https://cve.now/CVE-2024-9098.md): Privilege Escalation in lunary-ai/lunary (CVSS 7.3, lunary-ai/lunary)
- [CVE-2024-8502](https://cve.now/CVE-2024-8502.md): Remote Code Execution via Deserialization in modelscope/agentscope (CVSS 9.8, modelscope/agentscope · agentscope)
- [CVE-2024-12880](https://cve.now/CVE-2024-12880.md): Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow (CVSS 8.1, infiniflow/ragflow)
- [CVE-2024-10366](https://cve.now/CVE-2024-10366.md): IDOR in delete attachments in danny-avila/librechat (CVSS 7.6, danny-avila/librechat)
- [CVE-2024-8764](https://cve.now/CVE-2024-8764.md): Improper Authorization in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-6483](https://cve.now/CVE-2024-6483.md): Arbitrary File/Directory Deletion in aimhubio/aim (CVSS 5.3, aimhubio/aim · aim)
- [CVE-2024-10047](https://cve.now/CVE-2024-10047.md): Directory Listing Vulnerability in parisneo/lollms-webui (CVSS 5.3, parisneo/lollms-webui)
- [CVE-2024-10762](https://cve.now/CVE-2024-10762.md): Missing Authorization in lunary-ai/lunary (CVSS 8.1, lunary-ai/lunary)
- [CVE-2025-0330](https://cve.now/CVE-2025-0330.md): Exposure of Sensitive Information in berriai/litellm (CVSS 7.5, berriai/litellm · litellm)
- [CVE-2024-9053](https://cve.now/CVE-2024-9053.md): Remote Code Execution in vllm-project/vllm (CVSS 9.8, vllm-project/vllm · vllm)
- [CVE-2024-12039](https://cve.now/CVE-2024-12039.md): Improper Restriction of Excessive Authentication Attempts in langgenius/dify (CVSS 7.4, langgenius/dify)
- [CVE-2024-9597](https://cve.now/CVE-2024-9597.md): Path Traversal in parisneo/lollms (CVSS 7.1, parisneo/lollms)
- [CVE-2024-10835](https://cve.now/CVE-2024-10835.md): Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt (CVSS 9.1, eosphoros-ai/db-gpt · dbgpt)
- [CVE-2024-11044](https://cve.now/CVE-2024-11044.md): Open Redirect in automatic1111/stable-diffusion-webui (CVSS 6.1, automatic1111/stable-diffusion-webui)
- [CVE-2024-10724](https://cve.now/CVE-2024-10724.md): Stored XSS in IPV6 Section in phpipam/phpipam (CVSS 3.5, phpipam/phpipam)
- [CVE-2024-12216](https://cve.now/CVE-2024-12216.md): Arbitrary File Write via TarSlip in dmlc/gluon-cv (CVSS 7.1, dmlc/gluon-cv · gluoncv)
- [CVE-2024-10572](https://cve.now/CVE-2024-10572.md): Denial of Service and Arbitrary File Write in h2oai/h2o-3 (CVSS 7.5, h2oai/h2o-3 · h2o +1)
- [CVE-2024-8955](https://cve.now/CVE-2024-8955.md): SSRF in composiohq/composio (CVSS 6.8, composiohq/composio · composio-core)
- [CVE-2024-10109](https://cve.now/CVE-2024-10109.md): Incorrect Authorization in mintplex-labs/anything-llm (CVSS 8.3, mintplex-labs/anything-llm)
- [CVE-2024-8020](https://cve.now/CVE-2024-8020.md): Denial of Service in lightning-ai/pytorch-lightning (CVSS 7.5, lightning-ai/pytorch-lightning · pytorch-lightning +1)
- [CVE-2024-8489](https://cve.now/CVE-2024-8489.md): CSRF due to overly permissive CORS headers in modelscope/agentscope (CVSS 8.8, modelscope/agentscope)
- [CVE-2024-9000](https://cve.now/CVE-2024-9000.md): Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary (CVSS 7.1, lunary-ai/lunary)
- [CVE-2024-8581](https://cve.now/CVE-2024-8581.md): Path Traversal in parisneo/lollms-webui (CVSS 9.1, parisneo/lollms-webui)
- [CVE-2024-10812](https://cve.now/CVE-2024-10812.md): Open Redirect in binary-husky/gpt\_academic (CVSS 6.1, binary-husky/gpt\_academic)
- [CVE-2024-9606](https://cve.now/CVE-2024-9606.md): Improper Output Neutralization for Logs in berriai/litellm (CVSS 7.5, berriai/litellm · litellm)
- [CVE-2024-10723](https://cve.now/CVE-2024-10723.md): Stored XSS in phpipam/phpipam (CVSS 3.5, phpipam/phpipam)
- [CVE-2024-12775](https://cve.now/CVE-2024-12775.md): SSRF in langgenius/dify (CVSS 6.5, langgenius/dify)
- [CVE-2024-10110](https://cve.now/CVE-2024-10110.md): Denial of Service in aimhubio/aim (CVSS 7.5, aimhubio/aim · aim)
- [CVE-2024-8029](https://cve.now/CVE-2024-8029.md): Stored XSS in imartinez/privategpt (CVSS 4.7, imartinez/privategpt)
- [CVE-2024-9418](https://cve.now/CVE-2024-9418.md): Insufficiently Protected Credentials in transformeroptimus/superagi (CVSS 6.5, transformeroptimus/superagi)
- [CVE-2024-12909](https://cve.now/CVE-2024-12909.md): SQL Injection to RCE in run-llama/llama\_index (CVSS 10.0, run-llama/llama\_index · llama-index-packs-finchat)
- [CVE-2024-9363](https://cve.now/CVE-2024-9363.md): Unauthorized File Deletion in polyaxon/polyaxon (CVSS 7.5, polyaxon/polyaxon)
- [CVE-2024-9847](https://cve.now/CVE-2024-9847.md): Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress (CVSS 8.0, flatpressblog/flatpress)
- [CVE-2024-8984](https://cve.now/CVE-2024-8984.md): Denial of Service (DoS) in berriai/litellm (CVSS 7.5, berriai/litellm · litellm)
- [CVE-2024-10902](https://cve.now/CVE-2024-10902.md): Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt (CVSS 9.1, eosphoros-ai/db-gpt · dbgpt)
- [CVE-2024-10821](https://cve.now/CVE-2024-10821.md): Denial of Service (DoS) in invoke-ai/invokeai (CVSS 7.5, invoke-ai/invokeai · invokeai)
- [CVE-2024-12580](https://cve.now/CVE-2024-12580.md): Logs Debug Injection in danny-avila/librechat (CVSS 4.3, danny-avila/librechat)
- [CVE-2024-11031](https://cve.now/CVE-2024-11031.md): SSRF in binary-husky/gpt\_academic (CVSS 7.7, binary-husky/gpt\_academic)
- [CVE-2024-10725](https://cve.now/CVE-2024-10725.md): Stored Cross-site Scripting (XSS) in phpipam/phpipam (CVSS 3.5, phpipam/phpipam)
- [CVE-2024-10275](https://cve.now/CVE-2024-10275.md): Improper Role Modification by Admins for Billing Permissions in lunary-ai/lunary (CVSS 7.3, lunary-ai/lunary)
- [CVE-2024-11822](https://cve.now/CVE-2024-11822.md): Server-Side Request Forgery (SSRF) in langgenius/dify (CVSS 6.5, langgenius/dify)
- [CVE-2024-9900](https://cve.now/CVE-2024-9900.md): Cross-Site Scripting (XSS) in mudler/localai (CVSS 5.4, mudler/localai · github.com/mudler/LocalAI)
- [CVE-2024-8156](https://cve.now/CVE-2024-8156.md): Command Injection in significant-gravitas/autogpt (CVSS 8.8, significant-gravitas/autogpt)
- [CVE-2024-12910](https://cve.now/CVE-2024-12910.md): Denial of Service in run-llama/llama\_index (CVSS 4.2, run-llama/llama\_index · llama-index)
- [CVE-2025-0185](https://cve.now/CVE-2025-0185.md): Pandas Query Injection in langgenius/dify (CVSS 8.8, langgenius/dify)
- [CVE-2024-6838](https://cve.now/CVE-2024-6838.md): Uncontrolled Resource Consumption in mlflow/mlflow (CVSS 5.3, mlflow/mlflow · mlflow)
- [CVE-2024-10361](https://cve.now/CVE-2024-10361.md): Arbitrary File Deletion via Path Traversal in danny-avila/librechat (CVSS 8.1, danny-avila/librechat)
- [CVE-2025-0188](https://cve.now/CVE-2025-0188.md): SSRF in gaizhenbiao/chuanhuchatgpt (CVSS 6.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-11824](https://cve.now/CVE-2024-11824.md): Stored XSS in langgenius/dify (CVSS 5.8, langgenius/dify)
- [CVE-2024-10831](https://cve.now/CVE-2024-10831.md): Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt (CVSS 9.1, eosphoros-ai/db-gpt · dbgpt)
- [CVE-2024-2292](https://cve.now/CVE-2024-2292.md): Access Control Vulnerabilities lead to Violation of Privacy and Modification of Personal Data (CVSS 7.1, changeweb/unifiedtransform)
- [CVE-2024-12704](https://cve.now/CVE-2024-12704.md): Denial of Service (DoS) in run-llama/llama\_index (CVSS 7.5, run-llama/llama\_index · llama-index +1)
- [CVE-2024-9415](https://cve.now/CVE-2024-9415.md): Path Traversal in transformeroptimus/superagi (CVSS 8.8, transformeroptimus/superagi)
- [CVE-2024-10274](https://cve.now/CVE-2024-10274.md): Improper Authorization in lunary-ai/lunary (CVSS 6.5, lunary-ai/lunary)
- [CVE-2024-10553](https://cve.now/CVE-2024-10553.md): Jdbc Deserialization in h2oai/h2o-3 (CVSS 9.8, h2oai/h2o-3 · h2o +1)
- [CVE-2024-7760](https://cve.now/CVE-2024-7760.md): CSRF in aimhubio/aim (CVSS 7.4, aimhubio/aim · aim)
- [CVE-2024-10481](https://cve.now/CVE-2024-10481.md): Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui (CVSS 6.5, comfyanonymous/comfyui)
- [CVE-2024-7819](https://cve.now/CVE-2024-7819.md): CORS Misconfiguration in danswer-ai/danswer (CVSS 7.4, danswer-ai/danswer)
- [CVE-2024-11137](https://cve.now/CVE-2024-11137.md): IDOR Vulnerability in PATCH \`/v1/runs/:id/score\` Endpoint in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-11170](https://cve.now/CVE-2024-11170.md): Path Traversal in danny-avila/librechat (CVSS 8.8, danny-avila/librechat)
- [CVE-2024-11821](https://cve.now/CVE-2024-11821.md): Privilege Escalation in langgenius/dify (CVSS 4.3, langgenius/dify)
- [CVE-2024-12068](https://cve.now/CVE-2024-12068.md): Server-Side Request Forgery in haotian-liu/llava (CVSS 7.5, haotian-liu/llava)
- [CVE-2024-11037](https://cve.now/CVE-2024-11037.md): Path Traversal in binary-husky/gpt\_academic (CVSS 6.5, binary-husky/gpt\_academic)
- [CVE-2024-8763](https://cve.now/CVE-2024-8763.md): Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-12761](https://cve.now/CVE-2024-12761.md): Denial of Service in brycedrennan/imaginairy (CVSS 7.5, brycedrennan/imaginairy · imaginairy)
- [CVE-2024-10225](https://cve.now/CVE-2024-10225.md): Denial of Service in haotian-liu/llava (CVSS 7.5, haotian-liu/llava)
- [CVE-2024-11449](https://cve.now/CVE-2024-11449.md): Server-Side Request Forgery in haotian-liu/llava (CVSS 7.5, haotian-liu/llava)
- [CVE-2024-7779](https://cve.now/CVE-2024-7779.md): ReDoS (Regular Expression Denial of Service) in danswer-ai/danswer (CVSS 7.5, danswer-ai/danswer)
- [CVE-2024-11042](https://cve.now/CVE-2024-11042.md): Arbitrary File Delete in invoke-ai/invokeai (CVSS 9.1, invoke-ai/invokeai · invokeai)
- [CVE-2025-0452](https://cve.now/CVE-2025-0452.md): Arbitrary File Deletion in eosphoros-ai/DB-GPT (CVSS 8.2, eosphoros-ai/db-gpt)
- [CVE-2024-8999](https://cve.now/CVE-2024-8999.md): Improper Access Control in lunary-ai/lunary (CVSS 9.8, lunary-ai/lunary)
- [CVE-2024-9340](https://cve.now/CVE-2024-9340.md): Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml (CVSS 7.5, zenml-io/zenml · zenml)
- [CVE-2024-11302](https://cve.now/CVE-2024-11302.md): Missing check\_access in lollms\_binding\_infos in parisneo/lollms (CVSS 8.0, parisneo/lollms)
- [CVE-2024-12374](https://cve.now/CVE-2024-12374.md): Stored XSS in automatic1111/stable-diffusion-webui (CVSS 6.1, automatic1111/stable-diffusion-webui)
- [CVE-2024-7771](https://cve.now/CVE-2024-7771.md): Denial of Service in mintplex-labs/anything-llm (CVSS 6.5, mintplex-labs/anything-llm)
- [CVE-2024-8019](https://cve.now/CVE-2024-8019.md): Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning (CVSS 9.1, lightning-ai/pytorch-lightning · pytorch-lightning +1)
- [CVE-2024-8251](https://cve.now/CVE-2024-8251.md): Prisma Injection in mintplex-labs/anything-llm (CVSS 5.3, mintplex-labs/anything-llm)
- [CVE-2024-10940](https://cve.now/CVE-2024-10940.md): Exposure of Sensitive System Information via ImagePromptTemplate in langchain-ai/langchain (CVSS 5.3, langchain-ai/langchain · langchain-core)
- [CVE-2024-10273](https://cve.now/CVE-2024-10273.md): Improper Privilege Management in lunary-ai/lunary (CVSS 6.5, lunary-ai/lunary)
- [CVE-2025-0190](https://cve.now/CVE-2025-0190.md): Denial of Service in aimhubio/aim (CVSS 7.5, aimhubio/aim · aim)
- [CVE-2024-12055](https://cve.now/CVE-2024-12055.md): DoS using malicious gguf model file in ollama/ollama (CVSS 7.5, ollama/ollama · github.com/ollama/ollama)
- [CVE-2024-9095](https://cve.now/CVE-2024-9095.md): Improper Authorization in lunary-ai/lunary (CVSS 9.8, lunary-ai/lunary)
- [CVE-2024-10713](https://cve.now/CVE-2024-10713.md): Denial of Service (DoS) via Multipart Request in szad670401/hyperlpr (CVSS 7.5, szad670401/hyperlpr · hyperlpr3)
- [CVE-2025-1796](https://cve.now/CVE-2025-1796.md): Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify (CVSS 7.5, langgenius/dify)
- [CVE-2024-11441](https://cve.now/CVE-2024-11441.md): Stored XSS in Serge in serge-chat/serge (CVSS 6.1, serge-chat/serge)
- [CVE-2024-7765](https://cve.now/CVE-2024-7765.md): Denial of Service in h2oai/h2o-3 (CVSS 7.5, h2oai/h2o-3 · h2o +1)
- [CVE-2024-13060](https://cve.now/CVE-2024-13060.md): Improper Authorization in mintplex-labs/anything-llm (CVSS 4.3, mintplex-labs/anything-llm)
- [CVE-2024-12029](https://cve.now/CVE-2024-12029.md): Remote Code Execution via Model Deserialization in invoke-ai/invokeai (CVSS 9.8, invoke-ai/invokeai · invokeai)
- [CVE-2024-8501](https://cve.now/CVE-2024-8501.md): Arbitrary File Download in modelscope/agentscope (CVSS 7.5, modelscope/agentscope · agentscope)
- [CVE-2024-54016](https://cve.now/CVE-2024-54016.md): compression bomb attack in Apache Seata Server (CVSS 4.3, Apache Software Foundation Apache Seata · org.apache.seata:…)
- [CVE-2024-47552](https://cve.now/CVE-2024-47552.md): Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server (CVSS 9.8, Apache Software Foundation Apache Seata · org.apache.seata:…)
- [CVE-2025-2505](https://cve.now/CVE-2025-2505.md): Age Gate \<= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang' (CVSS 9.8, philsbury Age Gate)
- [CVE-2024-12016](https://cve.now/CVE-2024-12016.md): SQLi in CM Informatics' CM News (CVSS 9.8, CM Informatics CM News)
- [CVE-2025-1385](https://cve.now/CVE-2025-1385.md): Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration (CVSS 7.5, ClickHouse OSS)
- [CVE-2025-2108](https://cve.now/CVE-2025-2108.md): 140+ Widgets | Xpro Addons For Elementor – FREE \<= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget (CVSS 6.4, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2024-13881](https://cve.now/CVE-2024-13881.md): LinkMyPosts \<= 1.0 - Reflected XSS (CVSS 7.1, Link My Posts)
- [CVE-2024-13880](https://cve.now/CVE-2024-13880.md): My Quota \<= 1.0.8 - Reflected XSS (CVSS 7.1, My Quota)
- [CVE-2024-13878](https://cve.now/CVE-2024-13878.md): SpotBot \<= 0.1.8 - Reflected XSS (CVSS 7.1, SpotBot)
- [CVE-2024-13877](https://cve.now/CVE-2024-13877.md): Passbeemedia Web Push Notifications \<= 1.0.0 - Reflected XSS (CVSS 7.1, Passbeemedia Web Push Notification)
- [CVE-2024-13876](https://cve.now/CVE-2024-13876.md): Meintopf \<= 0.2.1 - Reflected XSS (CVSS 7.1, mEintopf)
- [CVE-2024-13875](https://cve.now/CVE-2024-13875.md): WP Programmmanager \<= 1.2 - Reflected XSS (CVSS 7.1, WP-PManager)
- [CVE-2025-22228](https://cve.now/CVE-2025-22228.md): CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length (CVSS 7.4, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2025-1766](https://cve.now/CVE-2025-1766.md): Event Manager, Events Calendar, Tickets, Registrations – Eventin \<= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update (CVSS 5.3, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2025-1770](https://cve.now/CVE-2025-1770.md): Event Manager, Events Calendar, Tickets, Registrations – Eventin \<= 4.0.24 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2025-1314](https://cve.now/CVE-2025-1314.md): Custom Twitter Feeds \<= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf\_clear\_cache\_admin Function (CVSS 4.3, smub Custom Twitter Feeds – A Tweets Widget or X Feed Widget)
- [CVE-2024-48590](https://cve.now/CVE-2024-48590.md): Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService. (CVSS 9.8)
- [CVE-2024-48591](https://cve.now/CVE-2024-48591.md): Inflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2024-57440](https://cve.now/CVE-2024-57440.md): D-Link DSL-3788 revA1 1.01R1B036\_EU\_EN is vulnerable to Buffer Overflow via the COMM\_MAKECustomMsg function of the webproc cgi (CVSS 7.5)
- [CVE-2025-25758](https://cve.now/CVE-2025-25758.md): An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANd (CVSS 7.5)
- [CVE-2025-26852](https://cve.now/CVE-2025-26852.md): DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection. (CVSS 10.0, Descor Infocad FM)
- [CVE-2025-26853](https://cve.now/CVE-2025-26853.md): DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema. (CVSS 10.0, Descor Infocad FM)
- [CVE-2025-29101](https://cve.now/CVE-2025-29101.md): Tenda AC8V4.0 V16.03.34.06 was discovered to contain a stack overflow via the deviceid parameter in the get\_parentControl\_list\_Info function (CVSS 7.5)
- [CVE-2025-29121](https://cve.now/CVE-2025-29121.md): A vulnerability was found in Tenda AC6 V15.03.05.16. (CVSS 7.5)
- [CVE-2025-29149](https://cve.now/CVE-2025-29149.md): Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function. (CVSS 7.5)
- [CVE-2025-29214](https://cve.now/CVE-2025-29214.md): Tenda AX12 v22.03.01.46\_CN was discovered to contain a stack overflow via the sub\_42F69C function at /goform/setMacFilterCfg. (CVSS 7.5)
- [CVE-2025-29215](https://cve.now/CVE-2025-29215.md): Tenda AX12 v22.03.01.46\_CN was discovered to contain a stack overflow via the sub\_43fdcc function at /goform/SetNetControlList. (CVSS 6.5)
- [CVE-2025-29217](https://cve.now/CVE-2025-29217.md): Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules. (CVSS 6.5)
- [CVE-2025-29218](https://cve.now/CVE-2025-29218.md): Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiPwd parameter at /goform/setModules. (CVSS 6.5)
- [CVE-2025-29410](https://cve.now/CVE-2025-29410.md): A cross-site scripting (XSS) vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbi (CVSS 6.1)
- [CVE-2025-29411](https://cve.now/CVE-2025-29411.md): An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute a (CVSS 9.8)
- [CVE-2025-29412](https://cve.now/CVE-2025-29412.md): A cross-site scripting (XSS) vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execu (CVSS 4.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.