Vendors / hiyouga Records 6 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 3
Exploited now hiyouga records in CISA KEV No hiyouga vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 81
LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00904 · Published 2026-06-30 · No fix listed CWE-829
Priority HIGH 81
LLama Factory enables fine-tuning of large language models.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02323 · Published 2024-11-21 · Fixed in 0.9.1 CWE-79
Priority HIGH 77
LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation.
CVSS 4.0 HIGH 8.7· Network · No auth · No interaction · EPSS 0.00507 · Published 2026-09-04 · No fix listed CWE-918
Priority HIGH 75
LLaMA-Factory is a tuning library for large language models.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0127 · Published 2025-06-26 · Fixed in 0.9.4 CWE-502
Priority HIGH 68
LLaMA-Factory is a tuning library for large language models.
CVSS 3.1 HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00383 · Published 2025-10-07 · Fixed in 0.9.4 CWE-22
Priority HIGH 67
LLama Factory enables fine-tuning of large language models.
CVSS 3.1 HIGH 7.8· Local · No auth · User interaction · EPSS 0.00285 · Published 2025-05-01 · Fixed in 1.0.0, 0.9.3 CWE-502
Open these records in search → All records by CVSS severity
3 3 0 0 0
THREATIST.IORead the docs