https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-9311.htmlhttps://patchthecve.com/cve/CVE-2024-9311.htmlWed, 17 Jun 2026 08:24:20 +0000MEDIUM 6.1: A Cross-Site Request Forgery (CSRF) vulnerability in haotian-liu/llava v1.2.0 (LLaVA-1.6) allows an attacker to upload files with malicious content without authentication or user interaction. The uploaded file is stored in a predictable path, enabling the attacker to execute arbitrary JavaScript codhttps://patchthecve.com/cve/CVE-2024-12070.htmlhttps://patchthecve.com/cve/CVE-2024-12070.htmlWed, 17 Jun 2026 06:58:59 +0000HIGH 7.5: A Denial of Service (DoS) vulnerability exists in the file upload feature of haotian-liu/llava, specifically in Release v1.2.0 (LLaVA-1.6). The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filehttps://patchthecve.com/cve/CVE-2024-11449.htmlhttps://patchthecve.com/cve/CVE-2024-11449.htmlWed, 17 Jun 2026 06:57:46 +0000HIGH 7.5: A vulnerability in haotian-liu/llava version 1.2.0 (LLaVA-1.6) allows for Server-Side Request Forgery (SSRF) through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insufficient validation