| LoLLMs is vulnerable to Improper Access Control through weak secret keyCVE-2026-1114 · GHSA-9296-V3FR-J92JVersion ranges need review. |
lollms |
PyPI |
Critical
|
Fix reported |
|
| parisneo/lollms has an insufficient session expiration vulnerabilityCVE-2026-1163 · GHSA-8JG2-726G-XH43Version ranges need review. |
lollms |
PyPI |
Medium
|
No fix reported |
|
| PYSEC-2026-2198CVE-2026-0558 · PYSEC-2026-2198 |
lollms |
PyPI |
Critical
|
Fix reported |
|
| PYSEC-2026-2199CVE-2026-0560 · PYSEC-2026-2199 |
lollms |
PyPI |
High
|
Fix reported |
|
| PYSEC-2026-2200CVE-2026-1116 · PYSEC-2026-2200 |
lollms |
PyPI |
Medium
|
Fix reported |
|
| lollms vulnerable to dot-dot-slash path traversal in XTTS serverCVE-2024-6139 · GHSA-W9QF-83JG-2X6CVersion ranges need review. |
lollms |
PyPI |
High
|
No fix reported |
|
| LoLLMS vulnerable to Expected Behavior ViolationCVE-2024-6281 · GHSA-8MRM-R7H3-C3HJVersion ranges need review. |
lollms |
PyPI |
High
|
Fix reported |
|
| LoLLMS Command Injection vulnerabilityCVE-2024-4078 · GHSA-PWC9-Q4HJ-PG8GVersion ranges need review. |
lollms |
PyPI |
High
|
Fix reported |
|
| path traversal vulnerability was identified in the parisneo/lollms-webui CVE-2024-4330 · GHSA-9P73-X86V-JW57Version ranges need review. |
lollms |
PyPI |
Medium
|
No fix reported |
|
| LoLLMS Path Traversal vulnerabilityCVE-2024-3429 · GHSA-3X47-W4RX-6PM7Version ranges need review. |
lollms |
PyPI |
High
|
Fix reported |
|
| Remote Code Execution in create_conda_env function in lollmsCVE-2024-3121 · GHSA-79H8-GXHQ-Q3JGVersion ranges need review. |
lollms |
PyPI |
Medium
|
No fix reported |
|
| Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user functionCVE-2025-6386 · GHSA-J5PR-VRJJ-9V4HVersion ranges need review. |
lollms |
PyPI |
High
|
No fix reported |
|
| lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCECVE-2024-5824 · GHSA-M45C-V46H-C788Version ranges need review. |
lollms |
PyPI |
High
|
Fix reported |
|
| lollms vulnerable to path traversal due to unauthenticated root folder settings changeCVE-2024-6085 · GHSA-9CHM-M6X2-6FVCVersion ranges need review. |
lollms |
PyPI |
High
|
No fix reported |
|
| LoLLMS Code Injection vulnerabilityCVE-2024-6982 · GHSA-JCCX-M9V4-9HWHVersion ranges need review. |
lollms |
PyPI |
High
|
Fix reported |
|
| Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.pyCVE-2024-6971 · GHSA-7PGR-32FX-C6X9Version ranges need review. |
lollms |
PyPI |
Low
|
No fix reported |
|
| Lollms has an Improper Access Control vulnerabilityCVE-2026-1117 · GHSA-82FW-CH24-J34WVersion ranges need review. |
lollms |
PyPI |
High
|
Fix reported |
|
| parisneo/lollms vulnerable to stored XSS in the social featureCVE-2026-1115 · GHSA-8WRQ-FV5F-PFP2Version ranges need review. |
lollms |
PyPI |
Critical
|
Fix reported |
|
| Remote Code Execution via path traversal bypass in lollmsCVE-2024-5443 · GHSA-MVRM-FH8Q-6WR2Version ranges need review. |
lollms |
PyPI |
Critical
|
Fix reported |
|
| parisneo/lollms Local File Inclusion (LFI) attackCVE-2024-4315 · GHSA-VQWR-Q6CC-C242Version ranges need review. |
lollms |
PyPI |
Critical
|
Fix reported |
|
