CVE Tools
Track your stack

Lollms

55 CVEs tracked since 2024. Since Apr 2024, none of them reached CISA KEV.

Lollms CVEs per month

Apr 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Lollms CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2024-0470
2024-05100
2024-06210
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-1060
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-03110
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Lollms's monthly top three, with their CVEs summed over those months.

  1. Lollms Web Ui415 months
  2. Lollms-webui73 months
  3. Lollms52 months
  4. Lord of Large Language Models11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Lollms.

  1. CVE-2026-12228Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms5.4
  2. CVE-2026-1116Cross-site Scripting (XSS) in parisneo/lollms6.1
  3. CVE-2026-1115Stored XSS in parisneo/lollms9.6
  4. CVE-2026-1114Improper Access Control via Weak JWT Token in parisneo/lollms9.8
  5. CVE-2026-0558Unauthenticated File Upload in parisneo/lollms9.8
  6. CVE-2026-0560Server-Side Request Forgery (SSRF) in parisneo/lollms7.5
  7. CVE-2026-0562Insecure Direct Object Reference (IDOR) in parisneo/lollms8.3
  8. CVE-2026-33340LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint9.1
  9. CVE-2024-12766SSRF in parisneo/lollms-webui7.5
  10. CVE-2024-8736Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui6.5
  11. CVE-2024-8898Path Traversal in parisneo/lollms-webui9.8
  12. CVE-2025-1451Insufficient Patch Leading to DoS in parisneo/lollms-webui7.5
  13. CVE-2024-6986Cross-site Scripting (XSS) in parisneo/lollms-webui5.4
  14. CVE-2024-10019Path Traversal and OS Command Injection in parisneo/lollms-webui6.7
  15. CVE-2024-9920Unrestricted File Upload and Execution in parisneo/lollms-webui8.8

The record

Peak rank
#34 in Jun 2024
Busiest month shown
Jun 2024, 21 CVEs
Months with a KEV entry
0 since Apr 2024
Monthly snapshots
5 since 2024
Lollms's full record, month by month