vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
Affects: vLLM
Advisories
Security advisories for popular AI software, newest first, each linked to its public source.
282 advisories rated Medium
Flowise: Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET…
Affects: Flowise
Flowise: Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech…
Affects: Flowise
Flowise: Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the…
Affects: Flowise
n8n: N8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP…
Affects: n8n
n8n: N8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in…
Affects: n8n
n8n: N8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch…
Affects: n8n
n8n: N8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level…
Affects: n8n
n8n: N8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit…
Affects: n8n
Keras: Keras model loading is vulnerable to denial of service through HDF5 shape bombs
Affects: Keras
llama.cpp: Llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the…
Affects: llama.cpp
llama.cpp: Llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent…
Affects: llama.cpp
Langflow: IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF)…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server…
Affects: Langflow
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks…
Affects: Open WebUI
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Affects: Open WebUI
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Affects: Open WebUI
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Affects: Open WebUI
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
Affects: Open WebUI
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Affects: Open WebUI
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
Affects: Open WebUI
Open WebUI: DNS Rebinding SSRF Bypass
Affects: Open WebUI
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding…
Affects: Open WebUI
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
Affects: Open WebUI
Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
Affects: Open WebUI
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
Affects: Open WebUI
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
Affects: Open WebUI
Flowise: Missing Authorization on Execution Update Endpoint
Affects: Flowise
Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private…
Affects: Flowise
Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
Affects: Flowise
Flowise: Incomplete Credential Redaction Exposes Secrets via API
Affects: Flowise
Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint
Affects: Flowise
Keras: HDF5 links can disclose local file contents
Affects: Keras
Langflow: IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in…
Affects: Langflow
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression…
Affects: n8n
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on…
Affects: n8n
n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner
Affects: n8n
Jupyter: JupyterLab: PyPI extension blocklist package-name canonicalization bypass
Affects: Jupyter
Jupyter: JupyterLab PluginManager lock-rule enforcement bypass
Affects: Jupyter
n8n: External Secrets Accessible via Workflow Expressions Outside Credentials
Affects: n8n
n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base…
Affects: n8n
n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
Affects: n8n
n8n: SSRF Protection Bypass via MCP Client Node
Affects: n8n
n8n: Google Service Account Private Key Exposed in JWT Header
Affects: n8n
n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
Affects: n8n
n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth…
Affects: n8n
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access
Affects: n8n