Ollama

Arbitrary file read in Ollama via tensor digest path traversal. A malicious OCI registry can trick Ollama into exfiltrating any file on the host — including SSH private keys — in three unauthenticated API calls....

SSRF in Ollama’s OCI registry redirect handling. A malicious registry can redirect blob downloads to internal endpoints, bypass hash verification, and exfiltrate full responses via the push API....