Open WebUI: Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte…
Affects: Open WebUI
Advisories
Security advisories for popular AI software, newest first, each linked to its public source.
331 advisories rated High
vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
Affects: vLLM
vLLM: vLLM has Remote DoS via Invalid Recovered Token Reinjection
Affects: vLLM
Weaviate: Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds…
Affects: Weaviate
MLflow: Trace API endpoints lack proper authorization validators
Affects: MLflow
Gradio: Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks
Affects: Gradio
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and…
Affects: Ray
NVIDIA Triton Inference Server: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a…
Affects: NVIDIA Triton Inference Server
NVIDIA Triton Inference Server: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause…
Affects: NVIDIA Triton Inference Server
n8n: N8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO…
Affects: n8n
Langflow: IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF)
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection…
Affects: Langflow
MLflow: A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7
Affects: MLflow
Ollama: Unauthenticated remote information disclosure vulnerability in Ollama's model quantization…
Affects: Ollama
Flowise: Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing…
Affects: Flowise
Flowise: Flowise before 3.0.10 contains an unverified password change vulnerability
Affects: Flowise
Flowise: Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of…
Affects: Flowise
Flowise: Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication…
Affects: Flowise
Flowise: Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API
Affects: Flowise
Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
Affects: Open WebUI
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
Affects: Open WebUI
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
Affects: Open WebUI
Open WebUI: Forged chat-file link allows cross-user file read and deletion
Affects: Open WebUI
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
Affects: Open WebUI
Langflow: Unauthenticated DoS through multipart form boundary file upload
Affects: Langflow
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access…
Affects: Langflow
n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
Affects: n8n
n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
Affects: n8n
n8n: Git Node Clone and Push Operations Bypass File Sandbox
Affects: n8n
n8n: Python sandbox escape
Affects: n8n
n8n: n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
Affects: n8n
n8n: n8n Has an Arbitrary File Read via Git Node
Affects: n8n
Langflow: IDOR/BOLA in Monitor API, Missing Ownership Enforcement on 7 Endpoints
Affects: Langflow
n8n: Denial of Service via ZIP decompression in webhook workflow
Affects: n8n
n8n: NoSQL Injection in MongoDB Node Find And Replace Operation
Affects: n8n
n8n: Microsoft SQL Node Prototype Pollution
Affects: n8n
n8n: Merge Node SQL Mode Prototype Pollution
Affects: n8n
Flowise: Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow…
Affects: Flowise
Flowise: Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change…
Affects: Flowise
vLLM: Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the…
Affects: vLLM
vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving
Affects: vLLM
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code…
Affects: vLLM
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected…
Affects: Flowise
Langflow: A vulnerability was identified in langflow-ai langflow up to 1.9.3
Affects: Langflow
LiteLLM: SSO Debug Flow Has Improper Authentication
Affects: LiteLLM
LiteLLM: M2M JWT Handler Has Improper Authorization
Affects: LiteLLM
LiteLLM: Admin Key Handler Has Improper Authorization
Affects: LiteLLM
vLLM: VLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal…
Affects: vLLM
vLLM: VLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS)…
Affects: vLLM
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
Affects: Open WebUI