Media
CVE-2026-1163
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 24
Restablecer filtros
Alta
CVE-2026-1117
Lollms has an Improper Access Control vulnerability
Alta
CVE-2025-6386
Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function
Alta
CVE-2024-6982
LoLLMS Code Injection vulnerability
Baja
CVE-2024-6971
Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py
Alta
CVE-2024-6281
LoLLMS vulnerable to Expected Behavior Violation
Alta
CVE-2024-5824
lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE
Media
CVE-2024-3121
Remote Code Execution in create_conda_env function in lollms
Alta
CVE-2024-6085
lollms vulnerable to path traversal due to unauthenticated root folder settings change
Alta
CVE-2024-6139
lollms vulnerable to dot-dot-slash path traversal in XTTS server
Alta
CVE-2024-3429
LoLLMS Path Traversal vulnerability
Media
CVE-2024-4330
path traversal vulnerability was identified in the parisneo/lollms-webui
Alta
CVE-2024-4078
LoLLMS Command Injection vulnerability
Media
CVE-2026-1116
A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of
Crítica
CVE-2026-1115
parisneo/lollms vulnerable to stored XSS in the social feature
Crítica
CVE-2026-1114
In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerabilit
Alta
CVE-2026-0560
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function
Alta
CVE-2026-0562
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function i
Crítica
CVE-2026-0558
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not e
Crítica
CVE-2024-6581
A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitize_svg function, this c
Media
CVE-2024-6985
A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the vi
Crítica
CVE-2024-5443
Remote Code Execution via path traversal bypass in lollms
Crítica
CVE-2024-4315
parisneo/lollms Local File Inclusion (LFI) attack
Alta
CVE-2024-4881
A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.