Vulnerabilidades em BerriAI
39 resultadosAnálise Vexday
A BerriAI apresenta um panorama de risco elevado com 24 vulnerabilidades catalogadas, das quais 20 foram publicadas nos últimos 90 dias, indicando descobertas recentes e potencialmente ainda sem mitigações maduras implantadas. Três vulnerabilidades estão sob ataque ativo (KEV) e quatro atingem nível crítico, com a fraqueza dominante em controle de acesso inadequado (CWE-285), o que representa risco direto à segurança de autenticação e autorização. A concentração de descobertas recentes exige monitoramento contínuo e priorização de patches, especialmente para os ativos explorados ativamente.
CVE-2026-42208CRITICALLiteLLM: SQL injection in Proxy API key verificationEPSS 89.4%KEVCVE-2026-42271HIGHLiteLLM: Authenticated command execution via MCP stdio test endpointsEPSS 83.0%KEVCVE-2026-33634CRITICALTrivy ecosystem supply chain briefly compromisedEPSS 59.2%KEVCVE-2024-6587HIGHSSRF in berriai/litellmEPSS 37.2%CVE-2026-35029HIGHLiteLLM affected by privilege escalation via unrestricted proxy configuration endpointEPSS 26.4%CVE-2026-40217HIGHLiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.EPSS 6.5%CVE-2024-6825HIGHRemote Code Execution in BerriAI/litellmEPSS 1.5%CVE-2024-2952CRITICALServer-Side Template Injection in BerriAI/litellmEPSS 1.3%CVE-2024-4264CRITICALRemote Code Execution in berriai/litellmEPSS 0.9%CVE-2024-5751CRITICALRemote Code Execution in BerriAI/litellmEPSS 0.9%CVE-2024-4889HIGHCode Injection in berriai/litellmEPSS 0.9%CVE-2024-8984HIGHDenial of Service (DoS) in berriai/litellmEPSS 0.8%CVE-2026-47101HIGHLiteLLM < 1.83.14 Privilege Escalation via API Key GenerationEPSS 0.7%CVE-2024-9606HIGHImproper Output Neutralization for Logs in berriai/litellmEPSS 0.7%CVE-2026-47102HIGHLiteLLM < 1.83.10 Privilege Escalation via User UpdateEPSS 0.7%CVE-2024-4888MEDIUMArbitrary File Deletion in BerriAI/litellmEPSS 0.6%CVE-2026-12773MEDIUMBerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authenticationEPSS 0.6%CVE-2026-49468CRITICALLiteLLM: Authentication Bypass via Host Header InjectionEPSS 0.6%CVE-2024-4890MEDIUMBlind SQL Injection in berriai/litellmEPSS 0.6%CVE-2024-10188HIGHDenial of Service in BerriAI/litellmEPSS 0.5%