Login Request a demo
BE
Vendor
BerriAI
1 product with CVEs on record
39
CVEs
4
On KEV
2
New 30D
Products
LI
litellm
BerriAI
9.8
39 CVEs4 on KEV2 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-108575
LI
LiteLLM
BerriAI
6.3
0%
Oct 11BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization
CVE-2026-108574
LI
LiteLLM
BerriAI
4.3
0%
Oct 11BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization
CVE-2026-59819
LI
Litellm
Litellm
4.9
1%
Jul 8LiteLLM: Local file read via request-supplied OIDC file references
CVE-2026-59822
In wildKEV
LI
Litellm
Litellm
8.2
1%
Jul 8LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
CVE-2026-59820
LI
Litellm
Litellm
6.5
1%
Jul 8LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-59821
LI
Litellm
Litellm
7.2
1%
Jul 8LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
CVE-2026-49468
LI
Litellm
Litellm
9.8
3%
Jun 22LiteLLM: Authentication Bypass via Host Header Injection
CVE-2026-12799
LI
litellm
BerriAI
4.3
0%
Jun 21BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization
CVE-2026-12798
LI
litellm
BerriAI
6.3
0%
Jun 21BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery
CVE-2026-12797
LI
litellm
BerriAI
6.3
0%
Jun 21BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization
CVE-2026-12796
LI
litellm
BerriAI
6.3
1%
Jun 21BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration
CVE-2026-12795
LI
litellm
BerriAI
7.3
1%
Jun 21BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication
CVE-2026-12774
LI
litellm
BerriAI
6.3
0%
Jun 21BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery
CVE-2026-12773
LI
litellm
BerriAI
9.8
1%
Jun 21BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication
CVE-2026-12772
LI
litellm
BerriAI
6.3
0%
Jun 21BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration
CVE-2026-12771
LI
litellm
BerriAI
7.5
0%
Jun 21BerriAI litellm M2M JWT user_api_key_auth.py improper authorization
CVE-2026-12770
LI
litellm
BerriAI
8.8
1%
Jun 21BerriAI litellm Admin Key key_management_endpoints.py improper authorization
CVE-2026-47102
LI
Litellm
Litellm
8.8
1%
May 21LiteLLM < 1.83.10 Privilege Escalation via User Update
CVE-2026-47101
LI
Litellm
Litellm
8.8
1%
May 21LiteLLM < 1.83.14 Privilege Escalation via API Key Generation
CVE-2026-42208
In wildKEV
LI
Litellm
Litellm
9.8
89%
May 8LiteLLM: SQL injection in Proxy API key verification
CVE-2026-42203
LI
Litellm
Litellm
8.8
0%
May 8LiteLLM: Server-Side Template Injection in /prompts/test endpoint
CVE-2026-42271
In wildKEV
LI
Litellm
Litellm
8.8
91%
May 8LiteLLM: Authenticated command execution via MCP stdio test endpoints
CVE-2026-40217
LI
Litellm
Litellm
8.8
16%
Apr 10LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI
CVE-2026-35030
LI
Litellm
Litellm
9.1
1%
Apr 6LiteLLM has an authentication bypass via OIDC userinfo cache key collision
CVE-2026-35029
LI
Litellm
Litellm
8.8
39%
Apr 6LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint
CVE-2026-33634
In wildKEV
LI
Litellm
Litellm
8.8
60%
Mar 23Trivy ecosystem supply chain briefly compromised
CVE-2025-45809
LI
Litellm
Litellm
5.4
0%
Jul 3SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API…
CVE-2025-0330
LI
Litellm
Litellm
7.5
1%
Mar 20In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings
CVE-2024-9606
LI
Litellm
Litellm
7.5
1%
Mar 20In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5…
CVE-2024-8984
LI
Litellm
Litellm
7.5
1%
Mar 20A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5
CVE-2024-6825
LI
Litellm
Litellm
8.8
2%
Mar 20BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution
CVE-2024-6587
LI
Litellm
Litellm
7.5
34%
Sep 13A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10
CVE-2024-5751
LI
Litellm
Litellm
9.8
1%
Jun 27BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution
CVE-2024-5710
LI
Litellm
Litellm
6.5
0%
Jun 27berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality
CVE-2024-5225
LI
Litellm
Litellm
7.2
0%
Jun 6An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint
CVE-2024-4890
LI
Litellm
Litellm
4.9
1%
Jun 6A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process
CVE-2024-4888
LI
Litellm
Litellm
8.1
1%
Jun 6BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint
CVE-2024-4889
LI
Litellm
Litellm
7.2
1%
Jun 6A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management…
CVE-2024-2952
LI
Litellm
Litellm
9.8
1%
Apr 10BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint