Read the docs

haotian-liu

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

haotian-liu records in CISA KEV

No haotian-liu vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Llava 5 records HIGH Large Language And Vision Assistant 3 records HIGH

Records

5 records in Llava · all components

TI-2024-08641 CVE-2024-9309 · GHSA-gggj-77q9-hf6x

SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava

Priority HIGH 79

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6).

CVSS 3.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00512 Published 2025-03-20 No fix listed CWE-918
TI-2024-11195 CVE-2024-12068 · GHSA-7hc9-vjg2-vpcr

Server-Side Request Forgery in haotian-liu/llava

Priority HIGH 72

A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.007 Published 2025-03-20 No fix listed CWE-918
TI-2024-11192 CVE-2024-12065 · GHSA-q36w-fgp3-q2gw

Local File Inclusion in haotian-liu/llava

Priority HIGH 72

A local file inclusion vulnerability exists in haotian-liu/llava at commit c121f04.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00945 Published 2025-03-20 No fix listed CWE-22
TI-2024-09481 CVE-2024-10225 · GHSA-745f-48gc-258q

Denial of Service in haotian-liu/llava

Priority HIGH 72

A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a multipart boundary in a file upload request.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00637 Published 2025-03-20 No fix listed CWE-770
TI-2024-08640 CVE-2024-9308 · GHSA-hjcr-w68h-rg2p

Open Redirect in haotian-liu/llava

Priority MEDIUM 60

An open redirect vulnerability in haotian-liu/llava version v1.2.0 (LLaVA-1.6) allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0053 Published 2025-03-20 No fix listed CWE-601
Open these records in search →