# cve.now: Parisneo

The newest entries naming Parisneo as an affected vendor (up to 200), of 84 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-10595](https://cve.now/CVE-2026-10595.md): Path Traversal Vulnerability in parisneo/lollms (CVSS 7.5)
- [CVE-2026-12228](https://cve.now/CVE-2026-12228.md): Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms (CVSS 8.7)
- [CVE-2026-1116](https://cve.now/CVE-2026-1116.md): Cross-site Scripting (XSS) in parisneo/lollms (CVSS 8.2)
- [CVE-2026-1115](https://cve.now/CVE-2026-1115.md): Stored XSS in parisneo/lollms (CVSS 9.6)
- [CVE-2026-1163](https://cve.now/CVE-2026-1163.md): Insufficient Session Expiration in parisneo/lollms (CVSS 4.1)
- [CVE-2026-1114](https://cve.now/CVE-2026-1114.md): Improper Access Control via Weak JWT Token in parisneo/lollms (CVSS 9.8)
- [CVE-2026-0558](https://cve.now/CVE-2026-0558.md): Unauthenticated File Upload in parisneo/lollms (CVSS 7.5)
- [CVE-2026-0560](https://cve.now/CVE-2026-0560.md): Server-Side Request Forgery (SSRF) in parisneo/lollms (CVSS 7.5)
- [CVE-2026-0562](https://cve.now/CVE-2026-0562.md): Insecure Direct Object Reference (IDOR) in parisneo/lollms (CVSS 8.3)
- [CVE-2026-33340](https://cve.now/CVE-2026-33340.md): LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint (CVSS 9.1)
- [CVE-2024-2356](https://cve.now/CVE-2024-2356.md): Remote Code Execution due to LFI in '/reinstall\_extension' in parisneo/lollms-webui (CVSS 9.6)
- [CVE-2026-1117](https://cve.now/CVE-2026-1117.md): Improper Access Control in parisneo/lollms (CVSS 8.2)
- [CVE-2025-6386](https://cve.now/CVE-2025-6386.md): Timing Attack Vulnerability in parisneo/lollms (CVSS 7.5)
- [CVE-2024-12766](https://cve.now/CVE-2024-12766.md): SSRF in parisneo/lollms-webui (CVSS 7.5)
- [CVE-2024-8736](https://cve.now/CVE-2024-8736.md): Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui (CVSS 7.1)
- [CVE-2024-8898](https://cve.now/CVE-2024-8898.md): Path Traversal in parisneo/lollms-webui (CVSS 6.7)
- [CVE-2025-1451](https://cve.now/CVE-2025-1451.md): Insufficient Patch Leading to DoS in parisneo/lollms-webui (CVSS 7.5)
- [CVE-2024-6986](https://cve.now/CVE-2024-6986.md): Cross-site Scripting (XSS) in parisneo/lollms-webui (CVSS 5.5)
- [CVE-2024-6982](https://cve.now/CVE-2024-6982.md): Remote Code Execution in Calculate Function in parisneo/lollms (CVSS 8.4)
- [CVE-2024-10019](https://cve.now/CVE-2024-10019.md): Path Traversal and OS Command Injection in parisneo/lollms-webui (CVSS 6.3)
- [CVE-2024-9920](https://cve.now/CVE-2024-9920.md): Unrestricted File Upload and Execution in parisneo/lollms-webui (CVSS 6.6)
- [CVE-2024-9919](https://cve.now/CVE-2024-9919.md): Missing Authentication Check in parisneo/lollms-webui (CVSS 8.4)
- [CVE-2024-7058](https://cve.now/CVE-2024-7058.md): Relative Path Traversal in parisneo/lollms-webui (CVSS 4.4)
- [CVE-2024-10047](https://cve.now/CVE-2024-10047.md): Directory Listing Vulnerability in parisneo/lollms-webui (CVSS 5.3)
- [CVE-2024-9597](https://cve.now/CVE-2024-9597.md): Path Traversal in parisneo/lollms (CVSS 7.1)
- [CVE-2024-8581](https://cve.now/CVE-2024-8581.md): Path Traversal in parisneo/lollms-webui (CVSS 9.1)
- [CVE-2024-11302](https://cve.now/CVE-2024-11302.md): Missing check\_access in lollms\_binding\_infos in parisneo/lollms (CVSS 8.0)
- [CVE-2024-5125](https://cve.now/CVE-2024-5125.md): XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui (CVSS 7.3)
- [CVE-2024-6673](https://cve.now/CVE-2024-6673.md): CSRF Vulnerability in parisneo/lollms-webui (CVSS 4.4)
- [CVE-2024-6581](https://cve.now/CVE-2024-6581.md): Remote Code Execution due to Stored XSS in parisneo/lollms (CVSS 6.5)
- [CVE-2024-6674](https://cve.now/CVE-2024-6674.md): Data Leak through CORS Misconfiguration in parisneo/lollms-webui (CVSS 8.1)
- [CVE-2024-6959](https://cve.now/CVE-2024-6959.md): Denial of Service (DOS) in multipart boundary while uploading file in parisneo/lollms-webui (CVSS 7.1)
- [CVE-2024-6985](https://cve.now/CVE-2024-6985.md): Path Traversal in api open\_personality\_folder in parisneo/lollms-webui (CVSS 4.4)
- [CVE-2024-6971](https://cve.now/CVE-2024-6971.md): Path Traversal in parisneo/lollms-webui (CVSS 3.4)
- [CVE-2024-6394](https://cve.now/CVE-2024-6394.md): Local File Inclusion in parisneo/lollms-webui (CVSS 7.5)
- [CVE-2024-6040](https://cve.now/CVE-2024-6040.md): Missing client\_id in parisneo/lollms-webui (CVSS 4.4)
- [CVE-2024-6281](https://cve.now/CVE-2024-6281.md): Path Traversal in parisneo/lollms (CVSS 7.3)
- [CVE-2024-4897](https://cve.now/CVE-2024-4897.md): Remote Code Execution in parisneo/lollms-webui (CVSS 8.4)
- [CVE-2024-5933](https://cve.now/CVE-2024-5933.md): Cross-site Scripting (XSS) in parisneo/lollms-webui (CVSS 6.1)
- [CVE-2024-6139](https://cve.now/CVE-2024-6139.md): Path Traversal in parisneo/lollms (CVSS 7.3)
- [CVE-2024-5824](https://cve.now/CVE-2024-5824.md): Path Traversal in parisneo/lollms (CVSS 7.4)
- [CVE-2024-6085](https://cve.now/CVE-2024-6085.md): Path Traversal in parisneo/lollms (CVSS 8.6)
- [CVE-2024-6250](https://cve.now/CVE-2024-6250.md): Absolute Path Traversal in parisneo/lollms-webui (CVSS 7.5)
- [CVE-2024-4498](https://cve.now/CVE-2024-4498.md): Path Traversal and RFI Vulnerability in parisneo/lollms-webui (CVSS 7.7)
- [CVE-2024-4839](https://cve.now/CVE-2024-4839.md): CSRF in Servers Configurations in parisneo/lollms-webui (CVSS 4.4)
- [CVE-2024-4499](https://cve.now/CVE-2024-4499.md): CSRF Vulnerability in parisneo/lollms XTTS Server (CVSS 7.6)
- [CVE-2024-3121](https://cve.now/CVE-2024-3121.md): Remote Code Execution in create\_conda\_env function in parisneo/lollms (CVSS 6.8)
- [CVE-2024-4841](https://cve.now/CVE-2024-4841.md): Path Traversal in parisneo/lollms-webui (CVSS 4.0)
- [CVE-2024-5443](https://cve.now/CVE-2024-5443.md): Remote Code Execution via Path Traversal in parisneo/lollms (CVSS 9.8)
- [CVE-2024-4315](https://cve.now/CVE-2024-4315.md): LFI Vulnerability due to Lack of Path Sanitization in parisneo/lollms (CVSS 9.1)
- [CVE-2024-4403](https://cve.now/CVE-2024-4403.md): CSRF in restart\_program in parisneo/lollms-webui (CVSS 4.4)
- [CVE-2024-4328](https://cve.now/CVE-2024-4328.md): CSRF in clear\_personality\_files\_list in parisneo/lollms-webui (CVSS 4.0)
- [CVE-2024-2359](https://cve.now/CVE-2024-2359.md): Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui (CVSS 9.8)
- [CVE-2024-2360](https://cve.now/CVE-2024-2360.md): Path Traversal leading to Remote Code Execution in parisneo/lollms-webui (CVSS 9.8)
- [CVE-2024-3429](https://cve.now/CVE-2024-3429.md): Path Traversal in parisneo/lollms (CVSS 9.8)
- [CVE-2024-3322](https://cve.now/CVE-2024-3322.md): Path Traversal in parisneo/lollms-webui (CVSS 8.4)
- [CVE-2024-1873](https://cve.now/CVE-2024-1873.md): Path Traversal and Denial of Service in parisneo/lollms-webui (CVSS 8.2)
- [CVE-2024-2288](https://cve.now/CVE-2024-2288.md): CSRF File Upload Vulnerability in parisneo/lollms-webui (CVSS 8.3)
- [CVE-2024-4320](https://cve.now/CVE-2024-4320.md): Remote Code Execution due to LFI in '/install\_extension' in parisneo/lollms-webui (CVSS 9.8)
- [CVE-2024-4881](https://cve.now/CVE-2024-4881.md): Path Traversal in parisneo/lollms (CVSS 7.5)
- [CVE-2024-2624](https://cve.now/CVE-2024-2624.md): Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui (CVSS 9.4)
- [CVE-2024-2548](https://cve.now/CVE-2024-2548.md): Path Traversal in parisneo/lollms-webui (CVSS 7.5)
- [CVE-2024-2362](https://cve.now/CVE-2024-2362.md): Path Traversal in parisneo/lollms-webui (CVSS 9.1)
- [CVE-2024-5482](https://cve.now/CVE-2024-5482.md): SSRF in add\_webpage endpoint in parisneo/lollms-webui (CVSS 7.4)
- [CVE-2024-2178](https://cve.now/CVE-2024-2178.md): Path Traversal Vulnerability in parisneo/lollms-webui (CVSS 7.5)
- [CVE-2024-4330](https://cve.now/CVE-2024-4330.md): Path Traversal in parisneo/lollms-webui (CVSS 4.0)
- [CVE-2024-4267](https://cve.now/CVE-2024-4267.md): Remote Code Execution in parisneo/lollms-webui (CVSS 8.4)
- [CVE-2024-2361](https://cve.now/CVE-2024-2361.md): Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui (CVSS 9.6)
- [CVE-2024-2366](https://cve.now/CVE-2024-2366.md): Remote Code Execution in parisneo/lollms-webui (CVSS 9.0)
- [CVE-2024-4078](https://cve.now/CVE-2024-4078.md): Arbitrary Code Execution in parisneo/lollms (CVSS 9.8)
- [CVE-2024-3435](https://cve.now/CVE-2024-3435.md): Path Traversal in parisneo/lollms-webui (CVSS 8.4)
- [CVE-2024-3126](https://cve.now/CVE-2024-3126.md): Command Injection in parisneo/lollms-webui (CVSS 8.4)
- [CVE-2024-4326](https://cve.now/CVE-2024-4326.md): Remote Code Execution via \`/apply\_settings\` and \`/execute\_code\` in parisneo/lollms-webui (CVSS 9.8)
- [CVE-2024-4322](https://cve.now/CVE-2024-4322.md): Path Traversal in parisneo/lollms-webui (CVSS 7.5)
- [CVE-2024-2358](https://cve.now/CVE-2024-2358.md): Path Traversal leading to Remote Code Execution in parisneo/lollms-webui (CVSS 9.8)
- [CVE-2024-2299](https://cve.now/CVE-2024-2299.md): Stored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webui (CVSS 7.4)
- [CVE-2024-1569](https://cve.now/CVE-2024-1569.md): Uncontrolled Resource Consumption in parisneo/lollms-webui (CVSS 5.3)
- [CVE-2024-1601](https://cve.now/CVE-2024-1601.md): SQL Injection in parisneo/lollms-webui (CVSS 7.5)
- [CVE-2024-1646](https://cve.now/CVE-2024-1646.md): Authentication Bypass in parisneo/lollms-webui (CVSS 8.2)
- [CVE-2024-1602](https://cve.now/CVE-2024-1602.md): Stored XSS leading to RCE in parisneo/lollms-webui (CVSS 8.8)
- [CVE-2024-1520](https://cve.now/CVE-2024-1520.md): OS Command Injection in parisneo/lollms-webui (CVSS 9.8)
- [CVE-2024-1511](https://cve.now/CVE-2024-1511.md): Path Traversal Vulnerability in parisneo/lollms-webui (CVSS 9.8)
- [CVE-2024-1600](https://cve.now/CVE-2024-1600.md): Local File Inclusion in parisneo/lollms-webui (CVSS 9.3)
- [CVE-2024-1522](https://cve.now/CVE-2024-1522.md): Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/parisneo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.