https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-22T22:59:56.217999+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-114493 fkie_cve-2026-114493 2026-10-22T22:59:56.247670+00:00

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.

 https://db.gcve.eu/vuln/ghsa-vhg8-m8fr-3863 GHSA-vhg8-m8fr-3863 2026-10-22T22:59:56.247814+00:00

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.