LiteLLM: LiteLLM vulnerable to reflected XSS in /sso/debug/callback
Affects: LiteLLM
Advisories
Security advisories for popular AI software, newest first, each linked to its public source.
282 advisories rated Medium
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke…
Affects: MLflow
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of…
Affects: vLLM
Jupyter: JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one…
Affects: Jupyter
Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain…
Affects: Langflow
vLLM: A security flaw has been discovered in vllm-project vLLM up to 0.31.0
Affects: vLLM
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS…
Affects: Langflow
vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
Affects: vLLM
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames…
Affects: vLLM
vLLM: Structured-output request errors escape the request boundary and terminate the shared…
Affects: vLLM
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments…
Affects: vLLM
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id…
Affects: vLLM
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
Affects: vLLM
vLLM: Mirrored multimodal IPC caches desync after a rejected request, a later request reusing the same…
Affects: vLLM
Jupyter: JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package…
Affects: Jupyter
Jupyter: JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files…
Affects: Jupyter
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing…
Affects: LiteLLM
vLLM: VLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST…
Affects: vLLM
vLLM: In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision /…
Affects: vLLM
vLLM: VLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated…
Affects: vLLM
vLLM: VLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its…
Affects: vLLM
vLLM: VLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder…
Affects: vLLM
vLLM: Vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat…
Affects: vLLM
vLLM: VLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where…
Affects: vLLM
vLLM: VLLM through 0.29.0 fails to properly validate bad_words token indices against the model's…
Affects: vLLM
vLLM: VLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel…
Affects: vLLM
vLLM: VLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead of model output…
Affects: vLLM
LiteLLM: LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
Affects: LiteLLM
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation
Affects: vLLM
vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions
Affects: vLLM
Flowise: A vulnerability was found in FlowiseAI Flowise up to 3.0.2
Affects: Flowise
vLLM: VLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription…
Affects: vLLM
Flowise: In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is…
Affects: Flowise
Flowise: Flowise before 3.1.4 contains a broken access control vulnerability in GET…
Affects: Flowise
Langflow: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain…
Affects: Langflow
Langflow: IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access…
Affects: Langflow
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
Affects: Open WebUI
Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
Affects: Open WebUI
Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
Affects: Open WebUI
Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
Affects: Open WebUI
Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
Affects: Open WebUI
Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
Affects: Open WebUI