{"schema_version":"1","data":[{"id":20667,"advisory_id":"9a9d4695-2d59-4a7c-8902-9c755e8ee2a3","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108836","source_published_at":"2026-10-12T12:45:16.156+00:00","published_at":"2026-10-25T05:31:54.561589+00:00","extraction_method":"structured","technologies":["core-cve","ollama"],"cve_ids":["CVE-2026-108836"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Ollama Pull API name.go IsValid server-side request forgery","summary":"A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.","evidence":"cve:CVE-2026-108836","products":[{"name":{"value":"Ollama","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-108836","aliases":["CVE-2026-108836"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*"],"vendor":"n/a","modules":["Pull API"],"product":"Ollama","versions":[{"status":"affected","version":"0.34.0"},{"status":"affected","version":"0.34.1"},{"status":"unaffected","version":"0.34.2"}]}],"modified":"2026-10-13T18:48:36.706Z","provider":"cve","references":["https://vuldb.com/vuln/416610","https://vuldb.com/vuln/416610/cti","https://vuldb.com/cve/CVE-2026-108836","https://vuldb.com/submit/972855","https://github.com/aLtEr6/test.git","https://github.com/ollama/ollama/pull/18512","https://github.com/aLtEr6/test/blob/main/test.pdf","https://github.com/ollama/ollama/commit/dfabde4539e42ba1e1eab50a3a50b88aea7958a0","https://github.com/ollama/ollama/releases/tag/v0.34.2","https://github.com/ollama/ollama/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108836","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T18:48:26.957311Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T18:48:36.706Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-12T12:45:16.156Z"}}},"related_cves":[{"value":"CVE-2026-108836","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12495,"advisory_id":"8b44c4f0-1ff8-43dc-9a12-67ad1419d27b","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103663","source_published_at":"2026-10-08T13:19:04.819+00:00","published_at":"2026-10-25T00:08:26.614215+00:00","extraction_method":"structured","technologies":["core-cve","ollama"],"cve_ids":["CVE-2026-103663"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Path Traversal leading to Remote Code Execution in Ollama","summary":"Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root. This issue was fixed in version 0.35.0.","evidence":"cve:CVE-2026-103663","products":[{"name":{"value":"Ollama","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-103663","aliases":["CVE-2026-103663"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"Server process does not have write access to `/usr/lib/ollama`"}]},{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.4,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"Server process has write access to `/usr/lib/ollama`"}]}],"affected":[{"repo":"https://github.com/ollama/ollama","vendor":"Ollama","product":"Ollama","versions":[{"status":"affected","version":"0.34.2","lessThan":"0.35.0","versionType":"semver"}],"defaultStatus":"unknown"}],"modified":"2026-10-08T14:04:14.270Z","provider":"cve","references":["https://cert.pl/en/posts/2026/10/CVE-2026-103663/","https://ollama.com/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-103663","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T14:04:06.230233Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T14:04:14.270Z"}}],"cna":{"orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","shortName":"CERT-PL","dateUpdated":"2026-10-08T13:19:04.819Z"}}},"related_cves":[{"value":"CVE-2026-103663","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3879,"advisory_id":"e4e4bf06-22cc-409a-b4cf-d296922a6a54","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102697","source_published_at":"2026-09-29T16:46:08.734+00:00","published_at":"2026-10-24T21:42:44.426548+00:00","extraction_method":"structured","technologies":["core-cve","ollama"],"cve_ids":["CVE-2026-102697"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization","summary":"Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.","evidence":"cve:CVE-2026-102697","products":[{"name":{"value":"ollama","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102697","aliases":["CVE-2026-102697"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"ollama","product":"ollama","versions":[{"status":"affected","version":"0.14.0","lessThan":"0.31.2","versionType":"semver"}],"packageURL":"pkg:golang/github.com/ollama/ollama","defaultStatus":"unaffected"}],"modified":"2026-09-29T17:28:26.473Z","provider":"cve","references":["https://github.com/ollama/ollama/commit/a2b3a5e9a3956bc0700a8505580c11faf4da09b5","https://github.com/ollama/ollama/releases/tag/v0.31.2","https://github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L204-L206","https://github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L389","https://github.com/ollama/ollama","https://www.vulncheck.com/advisories/ollama-0.14.0-before-0.31.2-experimental-agent-bash-approval-bypass-via-prefix-based-authorization"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102697","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T17:28:11.306364Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:28:26.473Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-29T16:46:08.734Z"}}},"related_cves":[{"value":"CVE-2026-102697","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":1562,"advisory_id":"146ea1a1-1eca-4217-8838-c0cd9b12c7e9","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85180","source_published_at":"2026-09-03T14:12:19.048+00:00","published_at":"2026-10-24T21:04:35.182202+00:00","extraction_method":"structured","technologies":["core-cve","ollama"],"cve_ids":["CVE-2026-85180"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect","summary":"Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.","evidence":"cve:CVE-2026-85180","products":[{"name":{"value":"ollama","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85180","aliases":["CVE-2026-85180"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"ollama","product":"ollama","versions":[{"status":"affected","version":"0.30.0","versionType":"semver","lessThanOrEqual":"0.33.2"}],"packageURL":"pkg:golang/github.com/ollama/ollama","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:20:48.767Z","provider":"cve","references":["https://github.com/ollama/ollama/issues/17041","https://github.com/ollama/ollama","https://github.com/ollama/ollama/blob/v0.33.2/x/transfer/download.go","https://www.vulncheck.com/advisories/ollama-0.30.0-through-0.33.2-ssrf-via-cross-host-tensor-blob-redirect"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85180","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-03T14:41:25.462957Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-03T14:41:50.099Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:20:48.767Z"}}},"related_cves":[{"value":"CVE-2026-85180","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":905,"advisory_id":"17c86c56-c9d4-4e32-9425-93045d6be0c4","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-65315","source_published_at":"2026-07-21T21:18:24.567+00:00","published_at":"2026-10-24T20:52:40.810139+00:00","extraction_method":"structured","technologies":["core-cve","ollama"],"cve_ids":["CVE-2026-65315"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser","summary":"Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata array counts that are used as allocation sizes without validation against remaining file size. Attackers can upload a sub-1KB crafted GGUF file via the blob upload and model create or pull API endpoints to trigger unrecoverable Go runtime out-of-memory fatal errors or makeslice panics that bypass recovery middleware and crash the entire server process.","evidence":"cve:CVE-2026-65315","products":[{"name":{"value":"Ollama","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-65315","aliases":["CVE-2026-65315"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Ollama","product":"Ollama","versions":[{"status":"affected","version":"0","versionType":"git","lessThanOrEqual":"f0078ae"}],"defaultStatus":"affected"}],"modified":"2026-09-24T14:18:16.098Z","provider":"cve","references":["https://github.com/ollama/ollama/issues/17042","https://github.com/ollama/ollama","https://www.vulncheck.com/advisories/ollama-remote-denial-of-service-via-attacker-controlled-allocation-in-gguf-metadata-parser"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-65315","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-07-22T18:21:09.443117Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-22T18:24:50.348Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:18:16.098Z"}}},"related_cves":[{"value":"CVE-2026-65315","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":20667,"next_before":905}