theopenco vulnerabilities

Products

• theopenco/llmgateway 1

Latest theopenco CVEs

Newest publication first

1. CVE-2026-108719 LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url

   Published 2026-10-11

   Medium·CVSS 5.3 EPSS 0.28%

   LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callback_url extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to wi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.