CVE Tools
Track your stack

Berriai

23 CVEs tracked since 2024. Since Jun 2024, none of them reached CISA KEV.

Berriai CVEs per month

Jun 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Berriai CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2024-0660
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-0360
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-06110
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-1011 or fewer
2026-113 or fewer

Products

The products that kept showing up in Berriai's monthly top three, with their CVEs summed over those months.

  1. Berriai/litellm122 months
  2. Litellm111 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Berriai.

  1. CVE-2026-114612LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key9.9
  2. CVE-2026-108575BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization6.3
  3. CVE-2026-108574BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization4.3
  4. CVE-2026-93355LiteLLM Weak JWT Authentication via Email-Based User Lookup8.1
  5. CVE-2026-89032BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer7.7
  6. CVE-2026-59823LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy—
  7. CVE-2026-84377LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters6.5
  8. CVE-2026-59819LiteLLM: Local file read via request-supplied OIDC file references4.9
  9. CVE-2026-59822LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback8.2
  10. CVE-2026-59820LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')6.5
  11. CVE-2026-59821LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks7.2
  12. CVE-2026-49468LiteLLM: Authentication Bypass via Host Header Injection9.8
  13. CVE-2026-12799BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization4.3
  14. CVE-2026-12798BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery6.3
  15. CVE-2026-12797BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization6.3

The record

Peak rank
#109 in Jun 2024
Busiest month shown
Jun 2026, 11 CVEs
Months with a KEV entry
0 since Jun 2024
Monthly snapshots
3 since 2024
Berriai's full record, month by month