Ollama — Vulnerabilities & Security Advisories 14

All 14 CVE vulnerabilities found in Ollama, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-108836	Ollama Pull API name.go IsValid server-side request forgery CWE-918	7.3	High	2026-10-12
CVE-2026-103663	Path Traversal leading to Remote Code Execution in Ollama CWE-23	9.4	Critical	2026-10-08
CVE-2026-102697	Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization CWE-863	7.8	High	2026-09-29
CVE-2026-86289	Ollama GGUF Decoder gguf.go readGGUFV1String integer overflow CWE-190	4.3	Medium	2026-09-07
CVE-2026-85180	Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect CWE-918	7.5	High	2026-09-03
CVE-2026-65315	Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser CWE-789	7.5	High	2026-07-21
CVE-2026-15685	Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability CWE-129	-	-	2026-07-13
CVE-2026-5757	There exists an unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine	-	-	2026-06-26
CVE-2026-7482	Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers CWE-125	9.1	Critical	2026-05-04
CVE-2026-42249	Remote Code Execution in Ollama via Update Mechanism CWE-494	8.8^AI	High ^AI	2026-04-29
CVE-2026-42248	Missing Signature Verification for Updates in Ollama CWE-494	8.4^AI	High ^AI	2026-04-29
CVE-2026-7020	Ollama Tensor Model Transfer transfer.go digestToPath path traversal CWE-22	3.7	Low	2026-04-26
CVE-2026-5530	Ollama Model Pull API download.go server-side request forgery CWE-918	6.3	Medium	2026-04-05
CVE-2025-15514	Ollama Multi-Modal Model Image Processing NULL Pointer Dereference CWE-395	8.7	High	2026-01-12

All 14 known CVE vulnerabilities affecting Ollama with full Chinese analysis, references, and POCs where available.