Medium
CVE-2026-84377
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 47
Reset filters
Medium
CVE-2026-59823
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
Low
CVE-2026-12796
BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
Low
CVE-2026-12797
BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
Low
CVE-2026-12771
LiteLLM: M2M JWT Handler Has Improper Authorization
Low
CVE-2026-12799
BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
Medium
CVE-2026-12773
LiteLLM: MCP Proxy Has Improper Authentication
Low
CVE-2026-12798
BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
Medium
CVE-2026-12795
LiteLLM: SSO Debug Flow Has Improper Authentication
Low
CVE-2026-12772
LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration
Low
CVE-2026-12770
LiteLLM: Admin Key Handler Has Improper Authorization
Critical
CVE-2026-37004
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
Medium
CVE-2026-55529
PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server
Medium
CVE-2026-59820
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Low
CVE-2026-59821
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
High
Exploited in attacks
CVE-2026-59822
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Low
CVE-2026-59819
LiteLLM: Local file read via request-supplied OIDC file references
High
CVE-2026-47102
LiteLLM allows a user to modify their own user_role via the /user/update endpoint
High
CVE-2026-47101
LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
High
CVE-2026-40217
LiteLLM has a sandbox escape in custom-code guardrail
High
CVE-2026-42203
LiteLLM: Server-Side Template Injection in /prompts/test endpoint
High
Exploited in attacks
CVE-2026-42271
LiteLLM: Authenticated command execution via MCP stdio test endpoints
High
CVE-2026-35029
LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
High
CVE-2026-34936
PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.