Security advisories

high2025-03-20

CVE-2025-0189-Aim Uncontrolled Resource Consumption vulnerability

aimhubio/aim · GHSA-j5qj-rg5j-j7c2

high2025-03-20

CVE-2025-0190-Aim Excessive Data Query Operations in a Large Data Table vulnerability

aimhubio/aim · GHSA-fm93-g6xp-35xq

high2025-03-20

CVE-2025-0628-LiteLLM Has an Improper Authorization Vulnerability

berriai/litellm · GHSA-fjcf-3j3r-78rp

high2025-03-20

CVE-2025-0315-Ollama Allocation of Resources Without Limits or Throttling vulnerability

ollama/ollama · GHSA-fccc-8m69-8r78

high2025-03-20

CVE-2025-0317-Ollama Divide By Zero vulnerability

ollama/ollama · GHSA-9gcr-28rp-cc24

high2025-03-20

CVE-2025-0330-LiteLLM Has a Leakage of Langfuse API Keys

berriai/litellm · GHSA-879v-fggm-vxw2

medium2025-03-20

CVE-2025-0453-MLflow Uncontrolled Resource Consumption vulnerability

mlflow/mlflow · GHSA-49m6-vrr9-2cqm

medium2025-03-20

CVE-2025-0508-SageMaker Workflow component allows possibility of MD5 hash collisions

aws/sagemaker-python-sdk · GHSA-32g6-mg92-ghm2

medium2025-03-20

CVE-2024-9900-LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality

mudler/localai · GHSA-w6hh-w36c-vxmw

high2025-03-20

CVE-2024-9606-LiteLLM Reveals Portion of API Key via a Logging File

berriai/litellm · GHSA-g5pg-73fc-hjwq

critical2025-03-20

CVE-2024-9701-Kedro deserialization vulnerability

kedro-org/kedro · GHSA-747f-ww56-4q4h

high2025-03-20

CVE-2024-9340-ZenML unauthenticated DoS via Multipart Boundry

zenml-io/zenml · GHSA-6gmf-2369-c76c

high2025-03-20

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability

open-webui/open-webui · GHSA-5ccf-884p-4jjq

critical2025-03-20

CVE-2024-9052-vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

vllm-project/vllm · GHSA-pgr7-mhp5-fgjp

high2025-03-20

CVE-2024-9229-Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary

quivrhq/quivr · GHSA-m76r-xqqj-mqmv

high2025-03-20

CVE-2024-9056-BentoML Denial of Service (DoS) via Multipart Boundary

bentoml/bentoml · GHSA-hw8j-hw49-752c

critical2025-03-20

CVE-2024-9053-vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints

vllm-project/vllm · GHSA-cj47-qj6g-x7r4

critical2025-03-20

CVE-2024-9070-BentoML deserialization vulnerability

bentoml/bentoml · GHSA-9g44-gwvm-hc44

medium2025-03-20

CVE-2024-8952-composio Server-Side Request Forgery (SSRF) vulnerability

composiohq/composio · GHSA-qvg9-vp87-h3hr

high2025-03-20

CVE-2024-8984-LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

berriai/litellm · GHSA-fh2c-86xm-pm2x