CVE-2026-1116 | Medium | 6.1 | 2026-04-12 | A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0… |
CVE-2026-1115 | Critical | 9.6 | 2026-04-10 | A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vul… |
CVE-2026-1114 | Critical | 9.8 | 2026-04-07 | In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing… |
CVE-2026-0562 | High | 8.3 | 2026-03-29 | A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other… |
CVE-2026-0560 | High | 7.5 | 2026-03-29 | A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint… |
CVE-2026-0558 | Critical | 9.8 | 2026-03-29 | A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract… |
CVE-2026-33340 | Critical | 9.1 | 2026-03-24 | LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability ha… |
CVE-2025-1451 | High | 7.5 | 2025-03-20 | A vulnerability in parisneo/lollms-webui v13 arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate t… |
CVE-2024-9920 | High | 8.8 | 2025-03-20 | In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentially dangerous ones li… |
CVE-2024-9919 | High | 8.4 | 2025-03-20 | A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninst… |
CVE-2024-8898 | Critical | 9.8 | 2025-03-20 | A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry). This vulnerability allo… |
CVE-2024-8736 | Medium | 6.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in multiple file upload endpoints of parisneo/lollms-webui version V12 (Strawberry). The vulnerability can be ex… |
CVE-2024-8581 | Critical | 9.1 | 2025-03-20 | A vulnerability in the `upload_app` function of parisneo/lollms-webui V12 (Strawberry) allows an attacker to delete any file or directory on the system. The fu… |
CVE-2024-7058 | Medium | 4.4 | 2025-03-20 | A vulnerability in the sanitize_path function in parisneo/lollms-webui v10 - latest allows an attacker to bypass path sanitization by using relative paths such… |
CVE-2024-6986 | Medium | 5.4 | 2025-03-20 | A Cross-site Scripting (XSS) vulnerability exists in the Settings page of parisneo/lollms-webui version 9.8. The vulnerability is due to the improper use of th… |
CVE-2024-12766 | High | 7.5 | 2025-03-20 | parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST API. Attackers can ex… |
CVE-2024-10047 | Medium | 5.3 | 2025-03-20 | parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows… |
CVE-2024-10019 | Medium | 6.7 | 2025-03-20 | A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function d… |
CVE-2024-5125 | High | 7.3 | 2024-11-14 | parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files… |
CVE-2024-6674 | High | 7.1 | 2024-10-29 | A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settin… |
CVE-2024-6673 | Medium | 6.5 | 2024-10-29 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the `install_comfyui` endpoint of the `lollms_comfyui.py` file in the parisneo/lollms-webui reposit… |
CVE-2024-6581 | Critical | 9.0 | 2024-10-29 | A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filte… |
CVE-2024-6959 | High | 7.1 | 2024-10-13 | A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file. If an attacker appends a large n… |
CVE-2024-6985 | Medium | 4.4 | 2024-10-11 | A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any f… |
CVE-2024-6971 | Medium | 4.4 | 2024-10-11 | A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_databas… |
CVE-2024-6394 | High | 7.5 | 2024-09-30 | A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the `ser… |
CVE-2024-6040 | High | 8.8 | 2024-08-01 | In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifica… |
CVE-2024-4897 | High | 8.4 | 2024-07-02 | parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python… |
CVE-2024-6250 | High | 7.5 | 2024-06-27 | An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The `sanitize_… |
CVE-2024-5933 | Medium | 5.4 | 2024-06-27 | A Cross-site Scripting (XSS) vulnerability exists in the chat functionality of parisneo/lollms-webui in the latest version. This vulnerability allows an attack… |
CVE-2024-4498 | High | 7.7 | 2024-06-25 | A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vuln… |
CVE-2024-4839 | Low | 3.3 | 2024-06-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The… |
CVE-2024-4499 | Medium | 6.3 | 2024-06-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows a… |
CVE-2024-3121 | Low | 3.3 | 2024-06-24 | A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from t… |
CVE-2024-4841 | Low | 3.3 | 2024-06-23 | A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input san… |
CVE-2024-4403 | High | 8.8 | 2024-06-10 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers… |
CVE-2024-4881 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0… |
CVE-2024-4320 | Critical | 9.8 | 2024-06-06 | A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@rou… |
CVE-2024-3429 | Critical | 9.8 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions i… |
CVE-2024-3322 | Critical | 9.8 | 2024-06-06 | A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vuln… |
CVE-2024-2624 | Critical | 9.8 | 2024-06-06 | A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_persona… |
CVE-2024-2548 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `lollms_core/lollms/server/endpoints/lollms_binding_fil… |
CVE-2024-2362 | Critical | 9.1 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Window… |
CVE-2024-2360 | Critical | 9.8 | 2024-06-06 | parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in… |
CVE-2024-2359 | Critical | 9.8 | 2024-06-06 | A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code. The issue arises f… |
CVE-2024-2288 | High | 8.3 | 2024-06-06 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lo… |
CVE-2024-1873 | Critical | 9.1 | 2024-06-06 | parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpo… |
CVE-2024-5482 | Critical | 9.8 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the 'add_webpage' endpoint of the parisneo/lollms-webui application, affecting the latest version… |
CVE-2024-2178 | High | 7.5 | 2024-06-02 | A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copy_to_custom_personas' endpoint in the 'lollms_personalities_inf… |
CVE-2024-4330 | Low | 3.3 | 2024-05-30 | A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to imprope… |
CVE-2024-4267 | Critical | 9.8 | 2024-05-22 | A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5. The vulnerability ari… |
CVE-2024-4326 | Critical | 9.8 | 2024-05-16 | A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protec… |
CVE-2024-4322 | High | 7.5 | 2024-05-16 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `ca… |
CVE-2024-3435 | High | 8.4 | 2024-05-16 | A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release bef… |
CVE-2024-3126 | High | 8.4 | 2024-05-16 | A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.p… |
CVE-2024-2366 | Critical | 9.0 | 2024-05-16 | A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstall_binding functionality in lollms_core/l… |
CVE-2024-2361 | Critical | 9.6 | 2024-05-16 | A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, t… |
CVE-2024-2358 | Critical | 9.8 | 2024-05-16 | A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises… |
CVE-2024-2299 | Medium | 6.1 | 2024-05-14 | A stored Cross-Site Scripting (XSS) vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile p… |
CVE-2024-1646 | High | 8.2 | 2024-04-16 | parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parame… |
CVE-2024-1601 | Critical | 9.8 | 2024-04-16 | An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discus… |
CVE-2024-1569 | High | 7.5 | 2024-04-16 | parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_c… |
CVE-2024-1602 | Medium | 6.1 | 2024-04-10 | parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting (XSS) that leads to Remote Code Execution (RCE). The vulnerability arises due to inadequate… |
CVE-2024-1600 | Critical | 9.3 | 2024-04-10 | A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exp… |
CVE-2024-1520 | Critical | 9.8 | 2024-04-10 | An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-s… |
CVE-2024-1511 | Critical | 9.8 | 2024-04-10 | The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allow… |
CVE-2024-1522 | High | 8.8 | 2024-03-30 | A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system… |