Loading story…
LoLLMs WEBUI was found to contain two high-severity vulnerabilities affecting core web application functionality. The most severe issue, tracked as CVE-2026-33340, is an unauthenticated server-side request forgery (SSRF) in the POST /api/proxy endpoint that affects all known existing versions. An attacker can abuse the endpoint to force the server to make arbitrary GET requests, potentially reaching internal services, scanning local networks, and retrieving sensitive cloud metadata, including possible AWS or GCP IAM tokens. The flaw is mapped to CWE-306 and CWE-918, with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, and no patched version was known at publication.
A second critical flaw, CVE-2026-0562, affects parisneo/lollms through an insecure direct object reference (IDOR) in friend request handling. In versions up to 2.2.0, the respond_request() function in backend/routers/friends.py failed to verify that the authenticated user was part of the targeted friendship, allowing any logged-in user to accept or reject another user's friend requests via /api/friends/requests/{friendship_id}. The weakness, mapped to CWE-863, could enable unauthorized actions, privacy violations, and social engineering abuse; unlike the SSRF issue, this bug includes references to a fixing commit and a Huntr report.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Reference material for CVE-2026-0562 included a fixing commit and Huntr advisory, indicating that remediation details were made available for the authorization flaw in parisneo/lollms. The fix addressed missing authorization checks in respond_request() within backend/routers/friends.py.
A critical insecure direct object reference vulnerability, later tracked as CVE-2026-0562, was received by security@huntr.dev. In versions up to 2.2.0, the /api/friends/requests/{friendship_id} endpoint lacked authorization checks, allowing authenticated users to accept or reject other users' friend requests.
A critical unauthenticated server-side request forgery flaw in the /api/proxy endpoint of LoLLMs WEBUI was disclosed, affecting all known existing versions. The issue could let attackers make arbitrary GET requests from the server to access internal services, scan local networks, or retrieve cloud metadata.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
InternLM's **LMDeploy** OpenAI-compatible API server is affected by **CVE-2026-63764**, a critical server-side request forgery flaw that lets unauthenticated attackers reach internal services by abusing image fetching in the `/v1/chat/completions` endpoint. The bug stems from validating only the initial `image_url` host and then following HTTP `302` redirects without re-checking whether subsequent destinations resolve to private or link-local addresses. As a result, an attacker can supply a public URL that redirects the server to targets such as `127.0.0.1` or the cloud metadata address `169.254.169.254`, potentially exposing internal-only applications and cloud IAM credentials. The vulnerability is tracked as **CWE-918** and has been rated **CVSS 9.2**; one affected build identified in public reporting is LMDeploy git version `648df3b`, while broader reporting says versions through **0.14.0** are impacted. A patch was merged to the main branch in **PR #4734**, but public reporting says no tagged release includes the fix yet. The issue was reportedly disclosed after a 36-day period without maintainer response following an initial report by researcher George Chen, increasing urgency for organizations running LMDeploy to review exposure and apply the upstream fix as soon as a release becomes available.
Jul 22, 2026
CERT Polska disclosed three vulnerabilities in **LMS (LAN Management System)**, including two high-severity issues tracked as `CVE-2026-40455` and `CVE-2026-40456`. The first is an authenticated SQL injection in `tarifflist.php` before commit `4cb30a7`, caused by insufficient sanitization of the POST `tg[]` parameter and unsafe query construction with `implode()`, allowing attackers to extract sensitive database information. The second is an OS command injection before commit `9fcb4de`, where an IP address parameter is passed to `exec()` without proper validation, enabling arbitrary operating system command execution. CERT Polska also reported `CVE-2026-40457`, a reflected XSS flaw in `dbrecover.php` and `netremap.php` before commit `9c5651b` that can trigger arbitrary JavaScript execution when an authenticated user opens a crafted link under certain conditions. The SQL injection and command injection bugs were both rated **High** with CVSS 4.0 base scores of **8.6**, and the disclosure credited **Tymoteusz Dominik** for responsibly reporting the issues. Organizations running LMS versions prior to the referenced commits should prioritize patching and review exposure of authenticated administrative functions.
Jun 29, 2026
LiteLLM fixed two high-severity vulnerabilities in version `1.83.0` that could allow attackers to gain elevated access in AI gateway deployments. **CVE-2026-35029** stems from missing admin authorization on the `/config/update` endpoint, allowing an authenticated low-privilege user to change proxy settings and environment variables. The flaw could be abused to register attacker-controlled Python handlers for remote code execution, read arbitrary server files, and overwrite UI credentials to seize privileged accounts, creating broad confidentiality, integrity, and availability risk. The same release also addressed **CVE-2026-35030**, an authentication bypass affecting LiteLLM deployments that enabled JWT-based authentication. In vulnerable versions, the platform used the first 20 characters of a token as the OIDC userinfo cache key, allowing a crafted token with a matching prefix to collide with a legitimate cached session and inherit that user’s identity and permissions. The issue is not enabled by default, limiting exposure to specific configurations, but together the flaws highlight significant access-control weaknesses in LiteLLM versions prior to `1.83.0`.
Jun 29, 2026