PyPI lollms

Name: PyPI lollms
Brand: PyPI

productUS

pkg:pypi/lollms

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

3critical3high3medium2low

updated 2026-10-27

vulnerabilities (24)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-3121US	low3.3	0.45% (39th)	Exploit	no fix	2024-06-24	≤ 9.5.1
CVE-2024-3429US	critical9.8	28.3% (98th)	—	9.5.0	2024-06-06	< 9.5.0
CVE-2026-0558US	critical9.8OT elevated	2.05% (81st)	—	2.1.1	2026-03-29	< 2.1.1
CVE-2026-0560US	high7.5	1.76% (78th)	—	2.1.1	2026-03-29	< 2.1.1
CVE-2026-1115US	—	1.26% (69th)	—	2.2.0	2026-04-10	< 2.2.0
CVE-2024-5443US	—	1.16% (67th)	—	9.5.1	2024-06-22	5.9.0 → 9.5.1
CVE-2024-4315US	—	1.02% (63rd)	—	9.5.0	2024-06-12	< 9.5.0
CVE-2024-4078US	—	0.92% (60th)	—	9.5.0	2024-05-16	< 9.5.0
CVE-2024-4881US	high7.5	0.89% (59th)	—	9.5.0	2024-06-06	2 versions
CVE-2024-6581US	critical9.0	0.65% (51st)	—	no fix	2024-10-29	2 versions
CVE-2024-6085US	—	0.64% (51st)	—	no fix	2024-06-27	≤ 9.5.1
CVE-2026-1117US	—	0.59% (48th)	—	2.1.0	2026-02-02	< 2.1.0
CVE-2026-1114US	—	0.54% (45th)	—	2.2.0	2026-04-07	2 versions
CVE-2024-6139US	—	0.52% (44th)	—	no fix	2024-06-27	≤ 9.5.1
CVE-2024-6982US	—	0.46% (40th)	—	11.0.0	2025-03-20	< 11.0.0
CVE-2024-5824US	—	0.45% (39th)	—	9.5.0	2024-06-27	< 9.5.0
CVE-2025-6386US	—	0.41% (35th)	—	no fix	2025-07-07	≤ 11.0.0
CVE-2024-6985US	medium4.4	0.36% (29th)	—	5.9.0	2024-10-11	2 versions
CVE-2024-6971US	medium4.4	0.32% (25th)	—	no fix	2024-10-11	≤ 9.5.1
CVE-2024-4330US	low3.3	0.29% (21st)	—	no fix	2024-05-30	—
CVE-2026-0562US	high8.3OT elevated	0.27% (20th)	—	2.1.1	2026-03-29	< 2.1.1
CVE-2024-6281US	—	0.27% (18th)	—	9.5.1	2024-07-20	< 9.5.1
CVE-2026-1116US	medium6.1	0.26% (17th)	—	2.1.1	2026-04-12	< 2.1.1
CVE-2026-1163US	—	0.23% (13th)	—	no fix	2026-04-08	≤ 11.0.0

The flaw types (CWEs) most of these CVEs share.

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')7 CVEs
CWE-29Path Traversal: '\..\filename'3 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-23Relative Path Traversal2 CVEs
CWE-284Improper Access Control2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs
CWE-203Observable Discrepancy1 CVEs
CWE-287Improper Authentication1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.