Vulnerabilities

TI-2025-04031 CVE-2025-4515 · GHSA-6j6m-gqwx-34j8

Zylon PrivateGPT settings.yaml cross-domain policy

MEDIUM 57

A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00363 Published 2025-05-10 No fix listed CWE-346

TI-2024-11191 CVE-2024-12063 · GHSA-q5v7-7r3x-m7hg

Denial of Service in imartinez/privategpt

HIGH 72

A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00788 Published 2025-03-20 No fix listed CWE-400

TI-2024-07432 CVE-2024-8018 · GHSA-2rr7-xrrm-67cf

Denial of Service (DOS) in imartinez/privategpt

HIGH 72

A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00637 Published 2025-03-20 No fix listed CWE-770

TI-2024-07443 CVE-2024-8029 · GHSA-34v4-5664-chqj

Stored XSS in imartinez/privategpt

MEDIUM 60

An XSS vulnerability was discovered in the upload file(s) process of imartinez/privategpt v0.5.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00356 Published 2025-03-20 No fix listed CWE-79

TI-2024-04045 CVE-2024-4343 · GHSA-ww4x-x76m-jf7h

Python Command Injection in imartinez/privategpt

HIGH 82

A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of the imartinez/privategpt application, versions up to and incl…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02685 Published 2024-11-14 Fixed in 0.6.0 CWE-78

TI-2024-05500 CVE-2024-5935 · GHSA-63x4-x48g-vgqg

CSRF Vulnerability in imartinez/privategpt

MEDIUM 58

A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00179 Published 2024-06-27 No fix listed CWE-352

TI-2024-05501 CVE-2024-5936 · GHSA-gxxw-7m39-6fjm

Open Redirect in imartinez/privategpt

MEDIUM 60

An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.30074 Published 2024-06-27 No fix listed CWE-601

TI-2024-04813 CVE-2024-5186 · GHSA-p7p2-4qrf-46qf

Server Side Request Forgery (SSRF) in imartinez/privategpt

HIGH 71

A Server-Side Request Forgery (SSRF) vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00344 Published 2024-06-06 No fix listed CWE-918

TI-2024-03174 CVE-2024-3403 · GHSA-8gh6-hmh2-v8c4

Local File Inclusion in imartinez/privategpt

HIGH 72

imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.011 Published 2024-05-16 No fix listed CWE-22

TI-2024-03591 CVE-2024-3851 · GHSA-rw5r-chjg-pmjp

Unrestricted File Upload Leading to XSS in imartinez/privategpt

LOW 24

A stored Cross-Site Scripting (XSS) vulnerability exists in the 'imartinez/privategpt' repository due to improper validation of file uploads.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00317 Published 2024-05-16 No fix listed CWE-79

Vulnerabilities

Filters