OpenAkita Operating System Command Injection Vulnerability

OpenAkita is a multi-platform, multi-intelligence collaborative AI assistant. An operating system command injection vulnerability exists in OpenAkita 1.24.3 and earlier versions. The vulnerability stems from the component Chat API Endpoint in the file src/openakita/tools/shell.py function run...

CVE-2026-3964 OpenAkita Chat API Endpoint shell.py run os command injection

A weakness has been identified in OpenAkita up to 1.24.3. This impacts the function run of the file src/openakita/tools/shell.py of the component Chat API Endpoint. Executing a manipulation of the argument Message can lead to os command injection. The attack is restricted to local execution. The...

PT-2026-24895

A weakness has been identified in OpenAkita up to 1.24.3. This impacts the function run of the file src/openakita/tools/shell.py of the component Chat API Endpoint. Executing a manipulation of the argument Message can lead to os command injection. The attack is restricted to local execution. The...

CVE-2026-27632 Talishar Vulnerable to Cross-Site Request Forgery (CSRF)

Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48, the Talishar application lacks Cross-Site Request Forgery CSRF protections on critical state-changing endpoints, specifically within SubmitChat.php and other game interaction handlers. By...

SUSE CVE-2025-15514

Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid...

CVE-2025-15514

A flaw was found in Ollama's multi-modal model image processing functionality. A remote attacker can exploit this by sending specially crafted base64-encoded image data to the /api/chat endpoint. This malformed input can lead to a null pointer dereference, causing a segmentation fault and crashin...

CVE-2025-15514

Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid...

CVE-2025-15514 Ollama Multi-Modal Model Image Processing NULL Pointer Dereference

Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid...

CVE-2025-15514

Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid...

CVE-2025-15514

CVE-2025-15514 affects Ollama 0.11.5-rc0 through 0.13.5, with a null pointer dereference in multi‑modal image processing. Malformed base64 image data passed to /api/chat can cause mtmd_helper_bitmap_init_from_buf to return NULL and be dereferenced, triggering a segmentation fault and DoS. Mitigat...

CVE-2025-15514 Ollama Multi-Modal Model Image Processing NULL Pointer Dereference

Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid...

PT-2026-2320

Name of the Vulnerable Software and Affected Versions Ollama versions 0.11.5-rc0 through 0.13.5 Description Ollama contains a flaw due to insufficient validation of base64-encoded image data. Specifically, when processing image data through the /api/chat endpoint, the application does not verify...

PT-2025-48062

Name of the Vulnerable Software and Affected Versions NVIDIA NeMo Agent Toolkit UI for Web affected versions not specified Description The software contains a Server-Side Request Forgery condition in the chat API endpoint. An attacker may exploit this to cause a Server-Side Request Forgery,...

EUVD-2025-21180

Malicious code in bioql PyPI...

PT-2026-51171

Name of the Vulnerable Software and Affected Versions vLLM versions 0.6.3 through 0.8.x Description Multiple regular expression denial of service ReDoS issues exist where several regex patterns are susceptible to catastrophic backtracking—a condition where a complex regex takes an exponential...

anything-llm 输入验证错误漏洞

anything-llm is an all-in-one desktop and Docker AI application open-sourced by Mintplex. An input validation error vulnerability exists in versions prior to anything-llm 1.2.2, which stems from the presence of Prisma injection in the API endpoint /embed/:embedId/stream-chat, which allows an...

PT-2025-4030 · Embedai · Embedai

Name of the Vulnerable Software and Affected Versions: EmbedAI versions 2.1 and below Description: An Improper Access Control issue has been found, allowing an authenticated attacker to write messages into other users' chat by changing the chat id parameter of the POST request "/embedai/chats/sen...

PT-2024-39250 · Unknown · Qdocs Smart School Management System

Name of the Vulnerable Software and Affected Versions: QDocs Smart School Management System version 7.0.0 Description: A critical vulnerability was found in the QDocs Smart School Management System. The issue affects an unknown functionality of the file /user/chat/mynewuser of the component Chat...

PT-2024-29378 · Organizr · Organizr

Name of the Vulnerable Software and Affected Versions: Organizr version 1.90 Description: The issue is a SQL injection problem. It occurs via the chat/setlike.php file. Recommendations: For Organizr version 1.90, consider restricting access to the chat/setlike.php file until a patch is available...

WordPress wp-live-chat-support plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. wp-live-chat-support plugin is used in one of the live chat plugin. A cross-site scripting vulnerability exists i...