ParisNeo vulnerabilities

CVEs per yearBy the year they were published

1. 202457
2. 202515
3. 202612

Newest CVEs

• CVE-2026-10595

  Path Traversal Vulnerability in parisneo/lollms

  parisneo · parisneo/lollms

  High7.5
• CVE-2026-12228

  Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms

  parisneo · parisneo/lollms

  High8.7
• CVE-2026-1116

  Cross-site Scripting (XSS) in parisneo/lollms

  parisneo · parisneo/lollms

  High8.2
• CVE-2026-1115

  Stored XSS in parisneo/lollms

  parisneo · parisneo/lollms

  Critical9.6
• CVE-2026-1163

  Insufficient Session Expiration in parisneo/lollms

  parisneo · parisneo/lollms

  Medium4.1
• CVE-2026-1114

  Improper Access Control via Weak JWT Token in parisneo/lollms

  parisneo · parisneo/lollms

  Critical9.8
• CVE-2026-0558

  Unauthenticated File Upload in parisneo/lollms

  parisneo · parisneo/lollms

  High7.5
• CVE-2026-0560

  Server-Side Request Forgery (SSRF) in parisneo/lollms

  parisneo · parisneo/lollms

  High7.5
• CVE-2026-0562

  Insecure Direct Object Reference (IDOR) in parisneo/lollms

  parisneo · parisneo/lollms

  High8.3
• CVE-2026-33340

  LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint

  ParisNeo · lollms-webui

  Critical9.1