High
CVE-2025-0628
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 47
Reset filters
High
CVE-2025-0330
LiteLLM Has a Leakage of Langfuse API Keys
High
CVE-2024-9606
LiteLLM Reveals Portion of API Key via a Logging File
High
CVE-2024-8984
LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
High
CVE-2024-6825
LiteLLM Vulnerable to Remote Code Execution (RCE)
High
CVE-2024-10188
LiteLLM Vulnerable to Denial of Service (DoS)
High
CVE-2024-6587
LiteLLM Server-Side Request Forgery (SSRF) vulnerability
Medium
CVE-2024-5710
litellm vulnerable to improper access control in team management
Medium
CVE-2024-5225
SQL injection in litellm
Medium
CVE-2024-4890
SQL injection in litellm
High
CVE-2024-4888
Arbitrary file deletion in litellm
High
CVE-2024-4264
litellm passes untrusted data to `eval` function without sanitization
Critical
CVE-2026-49468
LiteLLM: Authentication Bypass via Host Header Injection
Critical
CVE-2026-35030
LiteLLM: Authentication bypass via OIDC userinfo cache key collision
Critical
Exploited in attacks
CVE-2026-42208
LiteLLM has SQL Injection in Proxy API key verification
Critical
CVE-2024-5751
litellm vulnerable to remote code execution based on using eval unsafely
Critical
CVE-2024-2952
LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
Critical
ghsa-98x5-vq43-vc5p
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
Critical
CVE-2026-47391
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
High
ghsa-69x8-hrgq-fjj8
LiteLLM: Password hash exposure and pass-the-hash authentication bypass
Critical
ghsa-955r-262c-33jc
Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2
Critical
ghsa-5mg7-485q-xm76
Two LiteLLM versions published containing credential harvesting malware
Unrated
pysec-2026-2
Two litellm versions published containing credential harvesting malware
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.