Security advisories

high2025-03-20

CVE-2024-8061-Aim allows denial of service due to no timeouts for some tracking server endpoints

aimhubio/aim · GHSA-6w7p-xrvp-p7xv

high2025-03-20

CVE-2024-7983-Open WebUI denial of service through endpoint for converting markdown

open-webui/open-webui · GHSA-5v9m-57mq-qc75

high2025-03-20

CVE-2024-8062-H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request

h2oai/h2o-3 · GHSA-5c8j-g96x-cj78

high2025-03-20

CVE-2024-8183-Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

prefecthq/prefect · GHSA-4v9f-r55g-g6hc

high2025-03-20

CVE-2024-8063-Ollama Divide by Zero Vulnerability

ollama/ollama · GHSA-2xf2-gjm6-g2c6

medium2025-03-20

CVE-2024-7035-Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)

open-webui/open-webui · GHSA-p5vx-9hj8-cf4h

high2025-03-20

CVE-2024-7768-H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint

h2oai/h2o-3 · GHSA-p2vc-m5fv-9w9m

high2025-03-20

CVE-2024-7776-Open Neural Network Exchange (ONNX) Path Traversal Vulnerability

onnx/onnx · GHSA-h36j-8vv3-cj52

medium2025-03-20

CVE-2024-7046-Open WebUI Allows Viewing of Admin Details

open-webui/open-webui · GHSA-gv26-qw3h-8qvp

medium2025-03-20

CVE-2024-7045-Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read

open-webui/open-webui · GHSA-c7fq-p62p-wvpc

high2025-03-20

CVE-2024-7806-Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability

open-webui/open-webui · GHSA-85jc-8h5p-8vw8

high2025-03-20

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file

open-webui/open-webui · GHSA-6wj5-5pgr-jwq8

high2025-03-20

CVE-2024-7765-H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing

h2oai/h2o-3 · GHSA-6w62-3jvj-mfj6

critical2025-03-20

CVE-2024-8019-PyTorch Lightning path traversal vulnerability

pytorch/pytorch · GHSA-4cv3-v7pv-rfhf

high2025-03-20

CVE-2024-7053-Open WebUI Vulnerable to a Session Fixation Attack

open-webui/open-webui · GHSA-43g4-487m-5q6m

high2025-03-20

CVE-2024-7760-Aim vulnerable to Cross-Site Request Forgery

aimhubio/aim · GHSA-38r9-3j52-h92v

medium2025-03-20

CVE-2024-6577-TorchServe script references S3 bucket without ensuring ownership or confirming accessibility

pytorch/serve · GHSA-xx7c-j7h3-vjcq

high2025-03-20

CVE-2024-7036-Open WebUI Uncontrolled Resource Consumption vulnerability

open-webui/open-webui · GHSA-wcwp-9rcp-jvfg

medium2025-03-20

CVE-2024-6838-MLflow Uncontrolled Resource Consumption vulnerability

mlflow/mlflow · GHSA-q3gw-8236-5jw4

high2025-03-20

CVE-2024-6851-Aim Path Traversal vulnerability

aimhubio/aim · GHSA-mrvr-7493-pfq3