https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:10:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267080 EUVD-2026-267080 https://cve.radiocsirt.org/vuln/euvd-2026-267080 https://cve.radiocsirt.org/vuln/fkie_cve-2026-1117 <p>A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client&#39;s actions to affect the server&#39;s state and other clients&#39; operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service.</p> <p>A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client&#39;s actions to affect the server&#39;s state and other clients&#39; operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-1117 https://cve.radiocsirt.org/vuln/ghsa-82fw-ch24-j34w <p><strong>Affected:</strong> PyPI: lollms</p> <p>A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client&#39;s actions to affect the server&#39;s state and other clients&#39; operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service.</p> <p><strong>Affected:</strong> PyPI: lollms</p> <p>A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client&#39;s actions to affect the server&#39;s state and other clients&#39; operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service.</p> https://cve.radiocsirt.org/vuln/ghsa-82fw-ch24-j34w https://cve.radiocsirt.org/vuln/pysec-2026-1586 <p><strong>Affected:</strong> PyPI: lollms</p> <p>A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client&#39;s actions to affect the server&#39;s state and other clients&#39; operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service.</p> <p><strong>Affected:</strong> PyPI: lollms</p> <p>A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client&#39;s actions to affect the server&#39;s state and other clients&#39; operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1586