GCD AI RADAR
products/lollms

LoLLMs

Filed as: lollms, lollms-webui, LoLLMS, Lollms, LoLLMs WEBUI, LoLLMS WebUI

Records
33
Disclosed CVEs
33
Exploited (sev 3–4)
0
CISA KEV flagged
0

Newest record 2026-04-10 · 33 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)

Patch now: confirmed exploitation or KEV · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for LoLLMs has confirmed exploitation or a KEV flag.

Disclosures by month · last 24 months

Nov ’248 disclosed · peak 3 in Apr ’26Oct ’26

Disclosed CVEs, no confirmed exploitation · 33

  1. 2026-04-10
    CVE-2026-1115
    CVE-2026-1115: parisneo/lollms vulnerable to stored XSS in social feature
    2 Disclosedxss
    record AIR-2026-0564GitHub Advisory Database ↗
  2. 2026-04-08
    CVE-2026-1163
    CVE-2026-1163: parisneo/lollms insufficient session expiration vulnerability
    2 Disclosedsession-management
    record AIR-2026-0563GitHub Advisory Database ↗
  3. 2026-04-07
    CVE-2026-1114
    CVE-2026-1114: LoLLMs Weak JWT Secret Key Access Control Flaw
    2 Disclosedjwt · lollms · privilege-escalation
    record AIR-2026-0557GitHub Advisory Database ↗
  4. 2026-03-24
    CVE-2026-33340
    CVE-2026-33340: LoLLMs WEBUI contains a Server-Side Request Forgery vulnerability
    2 Disclosedssrf
    record AIR-2026-0997NVD ↗
  5. 2026-02-02
    CVE-2026-1117
    CVE-2026-1117: Lollms improper access control in generation events
    2 Discloseddos
    record AIR-2026-0443GitHub Advisory Database ↗
  6. 2025-07-07
    CVE-2025-6386
    CVE-2025-6386: Lollms Timing Attack Vulnerability in User Authentication
    2 Disclosedtiming-attack · lollms
    record AIR-2025-0306GitHub Advisory Database ↗
  7. 2025-03-20
    CVE-2024-11302
    CVE-2024-11302: Missing access check vulnerability in LoLLMs repository
    2 Disclosedinfra_vuln
    record AIR-2025-0408NVD ↗
  8. 2025-03-20
    CVE-2024-6982
    CVE-2024-6982: LoLLMS Code Injection and Sandbox Bypass
    2 Disclosedrce · lollms
    record AIR-2025-0221GitHub Advisory Database ↗
  9. 2024-10-29
    CVE-2024-6673
    CVE-2024-6673: CSRF vulnerability in LoLLMS WebUI ComfyUI installation endpoint
    2 Disclosedcsrf · lollms
    record AIR-2024-0262NVD ↗
  10. 2024-10-29
    CVE-2024-6581
    CVE-2024-6581: LoLLMs cross-site scripting vulnerability via SVG upload
    2 Disclosedxss
    record AIR-2024-0194GitHub Advisory Database ↗
  11. 2024-10-13
    CVE-2024-6959
    CVE-2024-6959: Lollms-webui denial of service vulnerability
    2 Discloseddos · lollms-webui
    record AIR-2024-0260NVD ↗
  12. 2024-10-11
    CVE-2024-6985
    CVE-2024-6985: LoLLMs path traversal in open_personality_folder endpoint
    2 Disclosedpath-traversal
    record AIR-2024-0191GitHub Advisory Database ↗
  13. 2024-10-11
    CVE-2024-6971
    CVE-2024-6971: LoLLMs Server path traversal vulnerability
    2 Disclosedpath-traversal
    record AIR-2024-0190GitHub Advisory Database ↗
  14. 2024-08-01
    CVE-2024-6040
    CVE-2024-6040: Missing client_id parameter leads to CSRF in lollms-webui
    2 Disclosedcsrf · lollms-webui
    record AIR-2024-0249NVD ↗
  15. 2024-07-20
    CVE-2024-6281
    CVE-2024-6281: LoLLMS path traversal vulnerability in settings
    2 Disclosedpath-traversal
    record AIR-2024-0150GitHub Advisory Database ↗
  16. 2024-07-02
    CVE-2024-4897
    CVE-2024-4897: RCE vulnerability in lollms-webui via insecure dependency
    2 Disclosedrce · supply_chain · infra_vuln
    record AIR-2024-0245NVD ↗
  17. 2024-06-27
    CVE-2024-5824
    CVE-2024-5824: lollms path traversal allows config override and RCE
    2 Disclosedpath-traversal · rce
    record AIR-2024-0148GitHub Advisory Database ↗
  18. 2024-06-27
    CVE-2024-6139
    CVE-2024-6139: lollms path traversal vulnerability in XTTS server
    2 Disclosedpath-traversal
    record AIR-2024-0147GitHub Advisory Database ↗
  19. 2024-06-27
    CVE-2024-6085
    CVE-2024-6085: Path traversal vulnerability in lollms
    2 Disclosedpath-traversal
    record AIR-2024-0145GitHub Advisory Database ↗
  20. 2024-06-24
    CVE-2024-4499
    CVE-2024-4499: CORS-related CSRF vulnerability in lollms XTTS server
    2 Disclosedcsrf · cors · infra_vuln
    record AIR-2024-0243NVD ↗
  21. 2024-06-24
    CVE-2024-4839
    CVE-2024-4839: CSRF vulnerability in lollms-webui server configurations function
    2 Disclosedcsrf · infra_vuln
    record AIR-2024-0242NVD ↗
  22. 2024-06-24
    CVE-2024-3121
    CVE-2024-3121: Remote Code Execution in lollms
    2 Disclosedrce
    record AIR-2024-0143GitHub Advisory Database ↗
  23. 2024-06-22
    CVE-2024-5443
    CVE-2024-5443: Lollms path traversal remote code execution
    2 Disclosedpath_traversal · lollms
    record AIR-2024-0141GitHub Advisory Database ↗
  24. 2024-06-12
    CVE-2024-4315
    CVE-2024-4315: Lollms Local File Inclusion vulnerability
    2 Disclosedlfi · lollms
    record AIR-2024-0138GitHub Advisory Database ↗
  25. 2024-06-06
    CVE-2024-2548
    CVE-2024-2548: Path Traversal Vulnerability in Lollms Web UI
    2 Disclosedpath-traversal
    record AIR-2024-0239NVD ↗
  26. 2024-06-06
    CVE-2024-2288
    CVE-2024-2288: CSRF and XSS Vulnerability in Lollms Web UI
    2 Disclosedcsrf · xss
    record AIR-2024-0237NVD ↗
  27. 2024-06-06
    CVE-2024-3429
    CVE-2024-3429: Path Traversal Vulnerability in LoLLMS
    2 Disclosedpath-traversal · lollms
    record AIR-2024-0132GitHub Advisory Database ↗
  28. 2024-06-06
    CVE-2024-4881
    CVE-2024-4881: Path Traversal Vulnerability in LoLLMS
    2 Disclosedpath-traversal
    record AIR-2024-0130GitHub Advisory Database ↗
  29. 2024-06-02
    CVE-2024-4330
    CVE-2024-4330: Path traversal in parisneo/lollms-webui
    2 Disclosedpath-traversal · lollms-webui
    record AIR-2024-0113GitHub Advisory Database ↗
  30. 2024-05-16
    CVE-2024-2366
    CVE-2024-2366: lollms-webui Remote Code Execution via Path Traversal
    2 Disclosedrce · infra_vuln
    record AIR-2024-0233NVD ↗
  31. 2024-05-16
    CVE-2024-4078
    CVE-2024-4078: LoLLMS Command Injection Vulnerability
    2 Disclosedrce · command-injection
    record AIR-2024-0107GitHub Advisory Database ↗
  32. 2024-05-14
    CVE-2024-2299
    CVE-2024-2299: Lollms-webui stored Cross-Site Scripting vulnerability
    2 Disclosedxss · csrf · infra_vuln
    record AIR-2024-0229NVD ↗
  33. 2024-03-30
    CVE-2024-1522
    CVE-2024-1522: Lollms-webui CSRF Remote Code Execution
    2 Disclosedcsrf · rce
    record AIR-2024-0220NVD ↗

This page lists what has been reported, not what to do about it. Versions and fixes are in each linked advisory; check the vendor’s own advisory before acting.