Security advisories

medium2025-03-20

CVE-2024-6863-H2O Vulnerable to Execution of Arbitrary Files

h2oai/h2o-3 · GHSA-m37h-8r48-2cxj

high2025-03-20

CVE-2024-7043-Open WebUI Allows Arbitrary File Reading and Deletion

open-webui/open-webui · GHSA-jrhc-9qg9-4qfq

high2025-03-20

CVE-2024-6982-LoLLMS Code Injection vulnerability

parisneo/lollms · GHSA-jccx-m9v4-9hwh

medium2025-03-20

CVE-2024-7044-Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload

open-webui/open-webui · GHSA-j274-m559-cj4j

high2025-03-20

CVE-2024-6827-Gunicorn HTTP Request/Response Smuggling vulnerability

benoitc/gunicorn · GHSA-hc5x-x2vx-497g

medium2025-03-20

CVE-2024-6844-Flask-CORS allows for inconsistent CORS matching

corydolphin/flask-cors · GHSA-8vgw-p6qm-5gr7

medium2025-03-20

CVE-2024-6839-Flask-CORS improper regex path matching vulnerability

corydolphin/flask-cors · GHSA-7rxf-gvfg-47g4

critical2025-03-20

CVE-2024-6829-Aim External Control of File Name or Path vulnerability

aimhubio/aim · GHSA-75px-35p4-qq6h

high2025-03-20

CVE-2024-6825-LiteLLM Vulnerable to Remote Code Execution (RCE)

berriai/litellm · GHSA-53gh-p8jc-7rg8

high2025-03-20

CVE-2024-6854-H2O Vulnerable to Arbitrary File Overwrite via File Export

h2oai/h2o-3 · GHSA-47f6-5p7h-5f3h

medium2025-03-20

CVE-2024-6866-Flask-CORS vulnerable to Improper Handling of Case Sensitivity

corydolphin/flask-cors · GHSA-43qf-4rqw-9q2g

critical2025-03-20

CVE-2024-12909-llama-index-packs-finchat SQL Injection vulnerability

run-llama/llama_index · GHSA-x48g-hm9c-ww42

high2025-03-20

Open WebUI has vulnerable dependency on starlette via fastapi

open-webui/open-webui · GHSA-w466-2wfc-8g58

high2025-03-20

CVE-2024-12886-Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP

ollama/ollama · GHSA-v464-r2r9-www7

medium2025-03-20

CVE-2024-6483-Aim Relative Path Traversal vulnerability

aimhubio/aim · GHSA-p6x3-v6g3-7557

medium2025-03-20

CVE-2024-12910-LlamaIndex Uncontrolled Resource Consumption vulnerability

run-llama/llama_index · GHSA-jvpf-xf32-2w4q

high2025-03-20

CVE-2024-12911-LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions

run-llama/llama_index · GHSA-jmgm-gx32-vp4w

high2025-03-20

CVE-2024-12778-Aim Uncontrolled Resource Consumption vulnerability

aimhubio/aim · GHSA-35p3-6j45-prwm

high2025-03-20

CVE-2024-12761-imaginAIry Denial of Service (DoS) vulnerability

brycedrennan/imaginairy · GHSA-x5xw-28w4-53j5

medium2025-03-20

CVE-2024-12777-Aim vulnerable to Synchronous Access of Remote Resource without Timeout

aimhubio/aim · GHSA-v5pj-jrpv-h6g2