Medium
CVE-2026-1163
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 24
Reset filters
High
CVE-2026-1117
Lollms has an Improper Access Control vulnerability
High
CVE-2025-6386
Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function
High
CVE-2024-6982
LoLLMS Code Injection vulnerability
Low
CVE-2024-6971
Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py
High
CVE-2024-6281
LoLLMS vulnerable to Expected Behavior Violation
High
CVE-2024-5824
lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE
Medium
CVE-2024-3121
Remote Code Execution in create_conda_env function in lollms
High
CVE-2024-6085
lollms vulnerable to path traversal due to unauthenticated root folder settings change
High
CVE-2024-6139
lollms vulnerable to dot-dot-slash path traversal in XTTS server
High
CVE-2024-3429
LoLLMS Path Traversal vulnerability
Medium
CVE-2024-4330
path traversal vulnerability was identified in the parisneo/lollms-webui
High
CVE-2024-4078
LoLLMS Command Injection vulnerability
Medium
CVE-2026-1116
A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of
Critical
CVE-2026-1115
parisneo/lollms vulnerable to stored XSS in the social feature
Critical
CVE-2026-1114
In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerabilit
High
CVE-2026-0560
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function
High
CVE-2026-0562
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function i
Critical
CVE-2026-0558
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not e
Critical
CVE-2024-6581
A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitize_svg function, this c
Medium
CVE-2024-6985
A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the vi
Critical
CVE-2024-5443
Remote Code Execution via path traversal bypass in lollms
Critical
CVE-2024-4315
parisneo/lollms Local File Inclusion (LFI) attack
High
CVE-2024-4881
A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.