Login Request a demo
LO
Vendor
Lollms
4 products with CVEs on record
68
CVEs
0
On KEV
0
New 30D
Products
LW
Lollms Web UI
Lollms
9.8
46 CVEs0 on KEV0 new
LO
Lollms
Lollms
9.8
12 CVEs0 on KEV0 new
LO
Lollms-webui
Lollms
9.8
9 CVEs0 on KEV0 new
LO
Lord OF Large Language Models
Lollms
9.0
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-12228
LO
Lollms
Lollms
5.4
0%
Jul 18Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms
CVE-2026-1116
LO
Lollms
Lollms
6.1
0%
Apr 12Cross-site Scripting (XSS) in parisneo/lollms
CVE-2026-1115
LO
Lollms
Lollms
9.6
1%
Apr 10Stored XSS in parisneo/lollms
CVE-2026-1114
LO
Lollms
Lollms
9.8
1%
Apr 7Improper Access Control via Weak JWT Token in parisneo/lollms
CVE-2026-0558
LO
Lollms
Lollms
9.8
2%
Mar 29Unauthenticated File Upload in parisneo/lollms
CVE-2026-0560
LO
Lollms
Lollms
7.5
2%
Mar 29Server-Side Request Forgery (SSRF) in parisneo/lollms
CVE-2026-0562
LO
Lollms
Lollms
8.3
0%
Mar 29Insecure Direct Object Reference (IDOR) in parisneo/lollms
CVE-2026-33340
LW
Lollms Web UI
Lollms
9.1
22%
Mar 24LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint
CVE-2024-12766
LW
Lollms Web UI
Lollms
7.5
1%
Mar 20SSRF in parisneo/lollms-webui
CVE-2024-8736
LW
Lollms Web UI
Lollms
6.5
0%
Mar 20Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui
CVE-2024-8898
LW
Lollms Web UI
Lollms
9.8
1%
Mar 20Path Traversal in parisneo/lollms-webui
CVE-2025-1451
LW
Lollms Web UI
Lollms
7.5
1%
Mar 20Insufficient Patch Leading to DoS in parisneo/lollms-webui
CVE-2024-6986
LW
Lollms Web UI
Lollms
5.4
0%
Mar 20Cross-site Scripting (XSS) in parisneo/lollms-webui
CVE-2024-10019
LW
Lollms Web UI
Lollms
6.7
1%
Mar 20Path Traversal and OS Command Injection in parisneo/lollms-webui
CVE-2024-9920
LW
Lollms Web UI
Lollms
8.8
1%
Mar 20Unrestricted File Upload and Execution in parisneo/lollms-webui
CVE-2024-9919
LW
Lollms Web UI
Lollms
8.4
0%
Mar 20Missing Authentication Check in parisneo/lollms-webui
CVE-2024-7058
LW
Lollms Web UI
Lollms
4.4
0%
Mar 20Relative Path Traversal in parisneo/lollms-webui
CVE-2024-10047
LW
Lollms Web UI
Lollms
5.3
1%
Mar 20Directory Listing Vulnerability in parisneo/lollms-webui
CVE-2024-8581
LW
Lollms Web UI
Lollms
9.1
1%
Mar 20Path Traversal in parisneo/lollms-webui
CVE-2024-5125
LO
Lollms-webui
Lollms
7.3
0%
Nov 14parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload…
CVE-2024-6674
LW
Lollms Web UI
Lollms
7.1
0%
Oct 29A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing…
CVE-2024-6673
LW
Lollms Web UI
Lollms
6.5
0%
Oct 29A Cross-Site Request Forgery (CSRF) vulnerability exists in the `install_comfyui` endpoint of the `lollms_comfyui.py` file in the parisneo/lollms-webui repository, versions v9.9…
CVE-2024-6581
LO
Lord OF Large Language Models
Lollms
9.0
1%
Oct 29A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files
CVE-2024-6959
LW
Lollms Web UI
Lollms
7.1
0%
Oct 13A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file
CVE-2024-6985
LO
Lollms
Lollms
4.4
0%
Oct 11A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui
CVE-2024-6971
LO
Lollms-webui
Lollms
4.4
0%
Oct 11A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file
CVE-2024-6394
LW
Lollms Web UI
Lollms
7.5
1%
Sep 30A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8
CVE-2024-6040
LW
Lollms Web UI
Lollms
8.8
0%
Aug 1In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities
CVE-2024-4897
LW
Lollms Web UI
Lollms
8.4
0%
Jul 2parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version…
CVE-2024-6250
LW
Lollms Web UI
Lollms
7.5
2%
Jun 27An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`
CVE-2024-5933
LW
Lollms Web UI
Lollms
5.4
0%
Jun 27A Cross-site Scripting (XSS) vulnerability exists in the chat functionality of parisneo/lollms-webui in the latest version
CVE-2024-4498
LW
Lollms Web UI
Lollms
7.7
0%
Jun 25A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest
CVE-2024-4839
LO
Lollms-webui
Lollms
3.3
0%
Jun 24A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest
CVE-2024-4499
LO
Lollms
Lollms
6.3
0%
Jun 24A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy
CVE-2024-3121
LO
Lollms
Lollms
3.3
0%
Jun 24A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0
CVE-2024-4841
LO
Lollms-webui
Lollms
3.3
1%
Jun 23A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization
CVE-2024-4403
LO
Lollms-webui
Lollms
8.8
0%
Jun 10A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6
CVE-2024-4881
LO
Lollms
Lollms
7.5
1%
Jun 6A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0
CVE-2024-4320
LW
Lollms Web UI
Lollms
9.8
34%
Jun 6A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the…
CVE-2024-3429
LO
Lollms
Lollms
9.8
28%
Jun 6A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in…
CVE-2024-3322
LW
Lollms Web UI
Lollms
9.8
1%
Jun 6A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5
CVE-2024-2624
LW
Lollms Web UI
Lollms
9.8
1%
Jun 6A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_personal_path")` endpoint…
CVE-2024-2548
LW
Lollms Web UI
Lollms
7.5
1%
Jun 6A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `lollms_core/lollms/server/endpoints/lollms_binding_files_server.py` and…
CVE-2024-2362
LW
Lollms Web UI
Lollms
9.1
1%
Jun 6A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform
CVE-2024-2360
LW
Lollms Web UI
Lollms
9.8
2%
Jun 6parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path'…
CVE-2024-2359
LW
Lollms Web UI
Lollms
9.8
1%
Jun 6A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code
CVE-2024-2288
LW
Lollms Web UI
Lollms
8.3
0%
Jun 6A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui…
CVE-2024-1873
LW
Lollms Web UI
Lollms
9.1
13%
Jun 6parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0
CVE-2024-5482
LW
Lollms Web UI
Lollms
9.8
1%
Jun 6A Server-Side Request Forgery (SSRF) vulnerability exists in the 'add_webpage' endpoint of the parisneo/lollms-webui application, affecting the latest version
CVE-2024-2178
LW
Lollms Web UI
Lollms
7.5
1%
Jun 2A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copy_to_custom_personas' endpoint in the 'lollms_personalities_infos.py' file
CVE-2024-4330
LW
Lollms Web UI
Lollms
3.3
0%
May 30A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6
CVE-2024-4267
LO
Lollms-webui
Lollms
9.8
1%
May 22A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5
CVE-2024-4326
LW
Lollms Web UI
Lollms
9.8
1%
May 16A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code
CVE-2024-4322
LW
Lollms Web UI
Lollms
7.5
31%
May 16A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint
CVE-2024-3435
LW
Lollms Web UI
Lollms
8.4
1%
May 16A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5
CVE-2024-3126
LW
Lollms Web UI
Lollms
8.4
1%
May 16A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script
CVE-2024-2366
LW
Lollms Web UI
Lollms
9.0
1%
May 16A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstall_binding functionality in…
CVE-2024-2361
LW
Lollms Web UI
Lollms
9.6
1%
May 16A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input
CVE-2024-2358
LW
Lollms Web UI
Lollms
9.8
1%
May 16A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code
CVE-2024-2299
LW
Lollms Web UI
Lollms
6.1
0%
May 14A stored Cross-Site Scripting (XSS) vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile picture upload…