Ollama vulnerable to Cross-Domain Token Exposure

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-51471 · ADVISORY
• ollama/ollama#10750 · WEB
• ollama/ollama · PACKAGE
• pypa/advisory-database · WEB
• huntr.com/bounties/94eea285-fd65-4e01-a035-f533575ebdc2 · WEB
• gecko.security/blog/cve-2025-51471 · WEB
• GitHub Advisory GHSA-x9hg-5q6g-q3jr · ADVISORY

Mais vulnerabilidades de github.com/ollama/ollama

• CVE-2026-7482CRÍTICO 9.1Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker…
• CVE-2026-7020BAIXO 3.7A security flaw has been discovered in Ollama up to 0.20.2. This affects the function digestToPath of the file x/imagegen/transfer/transfer.…
• CVE-2025-63389CRÍTICO 9.8A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The pla…
• CVE-2025-44779MÉDIO 6.6An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.
• CVE-2025-1975ALTO 7.5A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the man…