Advisory Catalog

Open WebUI Uncontrolled Resource Consumption vulnerability

Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP

Open WebUI has vulnerable dependency on starlette via fastapi

Open WebUI Uncontrolled Resource Consumption vulnerability

Open WebUI Uncontrolled Resource Consumption vulnerability

BentoML vulnerable to Uncontrolled Resource Consumption

Ollama Allows Out-of-Bounds Read

MLflow Cross-Site Request Forgery (CSRF) vulnerability

LiteLLM Has an Improper Authorization Vulnerability

MLflow Uncontrolled Resource Consumption vulnerability

LiteLLM Has a Leakage of Langfuse API Keys

Aim Excessive Data Query Operations in a Large Data Table vulnerability

Aim Uncontrolled Resource Consumption vulnerability

LiteLLM Reveals Portion of API Key via a Logging File

ZenML unauthenticated DoS via Multipart Boundry

Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary

An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the username is provided via an HTTP request from the client side, rather than being read from a secure

BentoML Denial of Service (DoS) via Multipart Boundary

LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

Gradio DOS in multipart boundry while uploading the file

composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL

composio Server-Side Request Forgery (SSRF) vulnerability

MLflow has a Local File Read/Path Traversal in dbfs

H2O Vulnerable to Arbitrary File Overwrite

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240802 allows attackers to access, copy, and delete other users' chat histories. This issue arises due to improper handling of session data and lack of access control mechanisms, enabling attackers to view and manipulate chat histories of other

AgentScope directory traversal vulnerability in /read-examples

AgentScope arbitrary file download vulnerability in rpc_agent_client

AgentScope Path Traversal in /api/file

Aim Improper Access Control

Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

Ollama Divide by Zero Vulnerability

H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request

Aim allows denial of service due to no timeouts for some tracking server endpoints

Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint

PyTorch Lightning denial of service vulnerability

Open WebUI denial of service through endpoint for converting markdown

H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint

H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing

Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload

Open WebUI Allows Arbitrary File Reading and Deletion

LoLLMS Code Injection vulnerability

Flask-CORS vulnerable to Improper Handling of Case Sensitivity

H2O Vulnerable to Arbitrary File Overwrite via File Export

Aim Path Traversal vulnerability

Gunicorn HTTP Request/Response Smuggling vulnerability

LiteLLM Vulnerable to Remote Code Execution (RCE)

LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions

Aim Uncontrolled Resource Consumption vulnerability

imaginAIry Denial of Service (DoS) vulnerability

Transformers Regular Expression Denial of Service (ReDoS) vulnerability