CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 moreDenial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpt7.5 High
- modelscope agentscope, modelscope/agentscope +1 morePath Traversal in modelscope/agentscope7.5 High
- haotian-liu haotian-liu/llava, hliu llava +1 moreLocal File Inclusion in haotian-liu/llava7.5 High
- danny-avila danny-avila/librechat, librechat +1 moreImproper Access Control in danny-avila/librechat9.4 Critical
- ollama, ollama ollama/ollama +1 moreAllocation of Resources Without Limits or Throttling in ollama/ollama7.5 High
- polyaxon polyaxon/polyaxonDirectory Traversal in polyaxon/polyaxon7.5 High
- vanna-ai vanna-ai/vannaServer-Side Request Forgery (SSRF) in vanna-ai/vanna8.3 High
- flatpress, flatpressblog flatpressblog/flatpress +1 moreCross-Site Scripting (XSS) in flatpressblog/flatpress7.5 High
- superagi, transformeroptimus transformeroptimus/superagi +1 moreImproper Privilege Management in transformeroptimus/superagi6.5 Medium
- parisneo parisneo/lollms, lollms web ui +1 moreRelative Path Traversal in parisneo/lollms-webui4.4 Medium
- llamaindex, run-llama run-llama/llama index +1 moreSQL Injection in run-llama/llama_index7.1 High
- haotian-liu haotian-liu/llava, hliu llava +1 moreSSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava9.3 Critical
- superagi, transformeroptimus transformeroptimus/superagi +1 moreInformation Disclosure in transformeroptimus/superagi7.5 High
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Authorization in lunary-ai/lunary7.6 High
- corydolphin corydolphin/flask-cors, flask-cors project flask-cors +1 moreImproper Regex Path Matching in corydolphin/flask-cors4.3 Medium
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 moreUnauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm7.5 High
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 moreArbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt9.1 Critical
- lunary, lunary-ai lunary-ai/lunary +1 morePrivilege Escalation in lunary-ai/lunary7.3 High
- modelscope modelscope/agentscopeRemote Code Execution via Deserialization in modelscope/agentscope9.8 Critical
- infiniflow infiniflow/ragflow, ragflow +1 morePartial Account Takeover due to Insecure Data Querying in infiniflow/ragflow8.1 High
- danny-avila danny-avila/librechat, librechat +1 moreIDOR in delete attachments in danny-avila/librechat7.6 High
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Authorization in lunary-ai/lunary7.5 High
- aimhubio aimhubio/aim, aimstack aim +1 moreArbitrary File/Directory Deletion in aimhubio/aim5.3 Medium
- lunary, lunary-ai lunary-ai/lunary +1 moreMissing Authorization in lunary-ai/lunary8.1 High
- parisneo parisneo/lollms-webui, lollms web ui +1 moreDirectory Listing Vulnerability in parisneo/lollms-webui5.3 Medium
- berriai berriai/litellm, litellm +1 moreExposure of Sensitive Information in berriai/litellm7.5 High
- vllm-project vllm, vllm-project/vllm +1 moreRemote Code Execution in vllm-project/vllm9.8 Critical
- langgenius dify, langgenius/dify +1 moreImproper Restriction of Excessive Authentication Attempts in langgenius/dify7.4 High
- parisneo parisneo/lollmsPath Traversal in parisneo/lollms7.1 High
- automatic1111 automatic1111/stable-diffusion-webui, stable-diffusion-webui +1 moreOpen Redirect in automatic1111/stable-diffusion-webui6.1 Medium
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 moreArbitrary File Write via SQL Injection in eosphoros-ai/db-gpt9.1 Critical
- dmlc dmlc/gluon-cvArbitrary File Write via TarSlip in dmlc/gluon-cv7.1 High
- phpipam, phpipam phpipam/phpipam +1 moreStored XSS in IPV6 Section in phpipam/phpipam3.5 Low
- h2o, h2oai h2oai/h2o-3 +1 moreDenial of Service and Arbitrary File Write in h2oai/h2o-37.5 High
- composio, composiohq composiohq/composio +1 moreSSRF in composiohq/composio6.8 Medium
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 moreIncorrect Authorization in mintplex-labs/anything-llm8.3 High
- modelscope modelscope/agentscopeCSRF due to overly permissive CORS headers in modelscope/agentscope8.8 High
- lightning-ai lightning-ai/pytorch-lightning, lightningai pytorch lightning +1 moreDenial of Service in lightning-ai/pytorch-lightning7.5 High
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary7.1 High
- parisneo parisneo/lollms-webui, lollms web ui +1 morePath Traversal in parisneo/lollms-webui9.1 Critical
- berriai berriai/litellm, litellm +1 moreImproper Output Neutralization for Logs in berriai/litellm7.5 High
- binary-husky binary-husky/gpt academic, gpt academic +1 moreOpen Redirect in binary-husky/gpt_academic6.1 Medium
- langgenius dify, langgenius/dify +1 moreSSRF in langgenius/dify6.5 Medium
- phpipam, phpipam phpipam/phpipam +1 moreStored XSS in phpipam/phpipam3.5 Low
- aimhubio aimhubio/aim, aimstack aim +1 moreDenial of Service in aimhubio/aim7.5 High
- superagi, transformeroptimus transformeroptimus/superagi +1 moreInsufficiently Protected Credentials in transformeroptimus/superagi6.5 Medium
- imartinez imartinez/privategpt, pribai privategpt +1 moreStored XSS in imartinez/privategpt4.7 Medium
- polyaxon polyaxon/polyaxonUnauthorized File Deletion in polyaxon/polyaxon7.5 High
- llamaindex, run-llama run-llama/llama index +1 moreSQL Injection to RCE in run-llama/llama_index10.0 Critical
- flatpress, flatpressblog flatpressblog/flatpress +1 moreCross-Site Request Forgery (CSRF) in flatpressblog/flatpress8.0 High
- Show moreLoading…