Login Request a demo
OL
Product
ollama
by ollama · last CVE Oct 12, 2026
32
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Vulnerabilities32In the news0Timeline
Severity mix
Critical 4High 21Medium 6Low 1
Severity
All severities32Critical4High21Medium6Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add ollama to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-103663
9.4
1%
Oct 8
Path Traversal leading to Remote Code Execution in Ollama
Affected: 0.34.2 before 0.35.0
CVE-2025-51471
6.9
19%
Jul 22
Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious…
Affected: 0.6.7
CVE-2025-44779
6.6
0%
Aug 7
An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull
Affected: 0.1.33
CVE-2024-28224
6.6
0%
Apr 8
Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language…
Affected: before 0.1.29
CVE-2026-5530
6.3
0%
Apr 5
Ollama Model Pull API download.go server-side request forgery
Affected: 0.18.0; 0.18.1
CVE-2026-86289
4.3
1%
Sep 7
Ollama GGUF Decoder gguf.go readGGUFV1String integer overflow
Affected: 0.31.0; 0.31.1
Showing 6