Coordinated disclosures

Security findings,
documented clearly.

Technical impact, reproduction details, remediation context, and links to the canonical advisory.

code-graph-rag Approval Bypass via GNU find -exec

code-graph-rag <= 0.0.669

GHSA-4p93-4vf7-4m8r18 Aug 2026↗High

lollms-webui Server-Side Request Forgery via /api/proxy

ParisNeo/lollms-webui

CVE-2026-333405 Mar 2026↗Critical

lollms-webui Unauthenticated Remote Code Execution via Insecure eval()

ParisNeo/lollms-webui 20.0 Alpha

GHSA-w6c4-c4gj-m2721 Mar 2026↗Critical

Ollama GGUF String Length Panic Denial of Service

Ollama < v0.3.14

CVE-2025-XXXXX12 Oct 2025↗High

Ollama Resource Exhaustion via Unbounded vocab_size

Ollama < v0.3.14

CVE-2025-XXXXX12 Oct 2025↗High

LiteLLM Sandbox Escape via Unicode Normalization Bypass

LiteLLM < v1.51.5

CVE-2025-XXXXX2 Sept 2025↗High

LiteLLM Server-Side Request Forgery inside Custom Guardrails

LiteLLM < v1.51.0

CVE-2025-XXXXX25 Aug 2025↗Critical

LiteLLM Authentication Bypass via Pass-the-Hash

LiteLLM < v1.50.0

CVE-2025-XXXXX10 Aug 2025↗