CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- danny-avila danny-avila/librechat, librechat +1 moreImproper Access Control in danny-avila/LibreChat5.4 Medium
- danny-avila danny-avila/librechat, librechat +1 moreImproper Input Validation in danny-avila/librechat7.5 High
- hamza417 hamza417/inureTask Hijacking in hamza417/inure5.5 Medium
- composio, composiohq composiohq/composio +1 moreAuthentication Bypass in composiohq/composio9.8 Critical
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 moreArbitrary File Write in eosphoros-ai/db-gpt9.1 Critical
- bentoml bentoml/bentomlDeserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml9.8 Critical
- vanna-ai vanna-ai/vannaCSRF in vanna-ai/vanna6.5 Medium
- parisneo parisneo/lollms-webui, lollms web ui +1 morePath Traversal and OS Command Injection in parisneo/lollms-webui6.3 Medium
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreIncorrect Authorization in gaizhenbiao/chuanhuchatgpt6.5 Medium
- lm-sys fastchat, lm-sys/fastchat +1 moreDenial of Service (DoS) via Multipart Boundary in lm-sys/fastchat7.5 High
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreStored XSS in gaizhenbiao/chuanhuchatgpt6.8 Medium
- automatic1111 automatic1111/stable-diffusion-webui, stable-diffusion-webui +1 moreCross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui9.6 Critical
- bentoml bentoml/bentomlDenial of Service in bentoml/bentoml7.5 High
- h2o, h2oai h2oai/h2o-3 +1 moreDenial of Service by ReDOS in h2oai/h2o-37.5 High
- superagi, transformeroptimus transformeroptimus/superagi +1 moreExposure of Sensitive Information in transformeroptimus/superagi6.5 Medium
- aimhubio aimhubio/aim, aimstack aim +1 moreDenial of Service in aimhubio/aim7.5 High
- aimhubio aimhubio/aim, aimstack aim +1 moreDenial of Service in aimhubio/aim7.5 High
- netease-youdao netease-youdao/qanything, youdao qanything +1 moreCORS Misconfiguration in netease-youdao/qanything7.5 High
- parisneo parisneo/lollms-webui, lollms web ui +1 moreUnrestricted File Upload and Execution in parisneo/lollms-webui6.6 Medium
- infiniflow infiniflow/ragflow, ragflow +1 moreRemote Code Execution in infiniflow/ragflow9.8 Critical
- phpipam, phpipam phpipam/phpipam +1 moreStored Cross-site Scripting (XSS) in phpipam/phpipam2.4 Low
- phpipam, phpipam phpipam/phpipam +1 moreCookie without Secure attribute in phpipam/phpipam5.3 Medium
- danny-avila danny-avila/librechat, librechat +1 moreDenial of Service in danny-avila/librechat7.5 High
- kedro-org kedro-org/kedroRemote Code Execution in kedro-org/kedro9.8 Critical
- binary-husky binary-husky/gpt academic, gpt academic +1 moreRegular Expression Denial of Service (ReDoS) in binary-husky/gpt_academic6.5 Medium
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 moreCross-Site Request Forgery (CSRF) in eosphoros-ai/db-gpt7.1 High
- danswer-ai danswer-ai/danswerCSRF in danswer-ai/danswer8.1 High
- netease-youdao netease-youdao/qanything, youdao qanything +1 moreHTTP Request Smuggling in netease-youdao/qanything7.5 High
- open-webui open-webui/open-webui, openwebui open webui +1 moreCross-Site Request Forgery (CSRF) in open-webui/open-webui6.9 Medium
- open-mmlab open-mmlab/mmdetectionRemote Code Execution by Pickle Deserialization in open-mmlab/mmdetection9.8 Critical
- ollama, ollama ollama/ollama +1 moreDivide By Zero in ollama/ollama7.5 High
- automatic1111 automatic1111/stable-diffusion-webui, stable-diffusion-webui +1 moreLocal File Inclusion in automatic1111/stable-diffusion-webui6.5 Medium
- lm-sys fastchat, lm-sys/fastchat +1 moreServer-Side Request Forgery in lm-sys/fastchat7.5 High
- danswer-ai danswer-ai/danswerDenial of Service in danswer-ai/danswer7.5 High
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Enforcement of Unique Constraint in lunary-ai/lunary6.5 Medium
- lunary, lunary-ai lunary-ai/lunary +1 moreBroken Access Control in lunary-ai/lunary4.3 Medium
- danny-avila danny-avila/librechat, librechat +1 moreUnhandled Exception Leading to Server Crash in danny-avila/librechat7.5 High
- binary-husky binary-husky/gpt academic, gpt academic +1 moreDeserialization of Untrusted Data in binary-husky/gpt_academic8.8 High
- lm-sys fastchat, lm-sys/fastchat +1 moreOpen Redirect in lm-sys/fastchat6.1 Medium
- h2o, h2oai h2oai/h2o-3 +1 moreArbitrary File Overwrite in h2oai/h2o-37.1 High
- parisneo parisneo/lollms-webui, lollms web ui +1 moreMissing Authentication Check in parisneo/lollms-webui8.4 High
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreLocal File Inclusion in gaizhenbiao/chuanhuchatgpt6.5 Medium
- aimhubio aimhubio/aim, aimstack aim +1 moreArbitrary File Deletion in aimhubio/aim7.5 High
- benoitc benoitc/gunicornHTTP Request Smuggling in benoitc/gunicorn7.5 High
- flatpress, flatpressblog flatpressblog/flatpress +1 moreStored XSS in flatpressblog/flatpress8.1 High
- lfprojects mlflow, mlflow mlflow/mlflow +1 morePath Traversal in mlflow/mlflow7.5 High
- danswer-ai danswer-ai/danswerDenial of Service in danswer-ai/danswer7.5 High
- horovod, horovod horovod/horovod +1 moreUnauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod9.8 Critical
- automatic1111 automatic1111/stable-diffusion-webui, stable-diffusion-webui +1 moreUnauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui7.5 High
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 morePath Traversal in mintplex-labs/anything-llm7.2 High
- Show moreLoading…