LoLLMs
Filed as: lollms, lollms-webui, LoLLMS, Lollms, LoLLMs WEBUI, LoLLMS WebUI
Newest record 2026-04-10 · 33 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)
Exploited or KEV-listed · 0
Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.
No record for LoLLMs has confirmed exploitation or a KEV flag.
Disclosures by month · last 24 months
Disclosed CVEs, no confirmed exploitation · 33
- closed9.6LoLLMs CVE-2026-1115: parisneo/lollms vulnerable to stored XSS in social feature
Disclosed · since 10 Apr 2026 · CVE-2026-1115
AI - closed4.1LoLLMs CVE-2026-1163: parisneo/lollms insufficient session expiration vulnerability
Disclosed · since 8 Apr 2026 · CVE-2026-1163
AI - closed9.8LoLLMs CVE-2026-1114: LoLLMs Weak JWT Secret Key Access Control Flaw
Disclosed · since 7 Apr 2026 · CVE-2026-1114
AI - closed9.1LoLLMs CVE-2026-33340: LoLLMs WEBUI contains a Server-Side Request Forgery vulnerability
Disclosed · since 24 Mar 2026 · CVE-2026-33340
AI - closed8.2LoLLMs CVE-2026-1117: Lollms improper access control in generation events
Disclosed · since 2 Feb 2026 · CVE-2026-1117
AI - closed7.5LoLLMs CVE-2025-6386: Lollms Timing Attack Vulnerability in User Authentication
Disclosed · since 7 Jul 2025 · CVE-2025-6386
AI - closed8.0LoLLMs CVE-2024-11302: Missing access check vulnerability in LoLLMs repository
Disclosed · since 20 Mar 2025 · CVE-2024-11302
AI - closed8.4LoLLMs CVE-2024-6982: LoLLMS Code Injection and Sandbox Bypass
Disclosed · since 20 Mar 2025 · CVE-2024-6982
AI - closed4.4LoLLMs CVE-2024-6673: CSRF vulnerability in LoLLMS WebUI ComfyUI installation endpoint
Disclosed · since 29 Oct 2024 · CVE-2024-6673
AI - closed6.5LoLLMs CVE-2024-6581: LoLLMs cross-site scripting vulnerability via SVG upload
Disclosed · since 29 Oct 2024 · CVE-2024-6581
AI - closed7.1LoLLMs CVE-2024-6959: Lollms-webui denial of service vulnerability
Disclosed · since 13 Oct 2024 · CVE-2024-6959
AI - closed6.9LoLLMs CVE-2024-6985: LoLLMs path traversal in open_personality_folder endpoint
Disclosed · since 11 Oct 2024 · CVE-2024-6985
AI - closed3.4LoLLMs CVE-2024-6971: LoLLMs Server path traversal vulnerability
Disclosed · since 11 Oct 2024 · CVE-2024-6971
AI - closed4.4LoLLMs CVE-2024-6040: Missing client_id parameter leads to CSRF in lollms-webui
Disclosed · since 1 Aug 2024 · CVE-2024-6040
AI - closed7.3LoLLMs CVE-2024-6281: LoLLMS path traversal vulnerability in settings
Disclosed · since 20 Jul 2024 · CVE-2024-6281
AI - closed8.4LoLLMs CVE-2024-4897: RCE vulnerability in lollms-webui via insecure dependency
Disclosed · since 2 Jul 2024 · CVE-2024-4897
AI - closed7.4LoLLMs CVE-2024-5824: lollms path traversal allows config override and RCE
Disclosed · since 27 Jun 2024 · CVE-2024-5824
AI - closed7.3LoLLMs CVE-2024-6139: lollms path traversal vulnerability in XTTS server
Disclosed · since 27 Jun 2024 · CVE-2024-6139
AI - closed8.6LoLLMs CVE-2024-6085: Path traversal vulnerability in lollms
Disclosed · since 27 Jun 2024 · CVE-2024-6085
AI - closed7.6LoLLMs CVE-2024-4499: CORS-related CSRF vulnerability in lollms XTTS server
Disclosed · since 24 Jun 2024 · CVE-2024-4499
AI - closed4.4LoLLMs CVE-2024-4839: CSRF vulnerability in lollms-webui server configurations function
Disclosed · since 24 Jun 2024 · CVE-2024-4839
AI - closed6.8LoLLMs CVE-2024-3121: Remote Code Execution in lollms
Disclosed · since 24 Jun 2024 · CVE-2024-3121
AI - closed9.8LoLLMs CVE-2024-5443: Lollms path traversal remote code execution
Disclosed · since 22 Jun 2024 · CVE-2024-5443
AI - closed9.1LoLLMs CVE-2024-4315: Lollms Local File Inclusion vulnerability
Disclosed · since 12 Jun 2024 · CVE-2024-4315
AI - closed7.5LoLLMs CVE-2024-2548: Path Traversal Vulnerability in Lollms Web UI
Disclosed · since 6 Jun 2024 · CVE-2024-2548
AI - closed8.3LoLLMs CVE-2024-2288: CSRF and XSS Vulnerability in Lollms Web UI
Disclosed · since 6 Jun 2024 · CVE-2024-2288
AI - closed9.8LoLLMs CVE-2024-3429: Path Traversal Vulnerability in LoLLMS
Disclosed · since 6 Jun 2024 · CVE-2024-3429
AI - closed7.7LoLLMs CVE-2024-4881: Path Traversal Vulnerability in LoLLMS
Disclosed · since 6 Jun 2024 · CVE-2024-4881
AI - closed4.0LoLLMs CVE-2024-4330: Path traversal in parisneo/lollms-webui
Disclosed · since 2 Jun 2024 · CVE-2024-4330
AI - closed9.0LoLLMs CVE-2024-2366: lollms-webui Remote Code Execution via Path Traversal
Disclosed · since 16 May 2024 · CVE-2024-2366
AI - closed9.8LoLLMs CVE-2024-4078: LoLLMS Command Injection Vulnerability
Disclosed · since 16 May 2024 · CVE-2024-4078
AI - closed7.4LoLLMs CVE-2024-2299: Lollms-webui stored Cross-Site Scripting vulnerability
Disclosed · since 14 May 2024 · CVE-2024-2299
AI - closed8.8LoLLMs CVE-2024-1522: Lollms-webui CSRF Remote Code Execution
Disclosed · since 30 Mar 2024 · CVE-2024-1522
AI
Fix status and fixed versions are recorded when a source states them (each record’s page shows what is known); check the vendor’s own advisory before acting.