Advisory Catalog

Apache Airflow Providers FAB Insufficient Session Expiration vulnerability

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabl

TorchServe vulnerable to bypass of allowed_urls configuration

Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib

JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the templat

Apache Superset vulnerable to improper SQL authorization

langchain-experimental vulnerable to Arbitrary Code Execution

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to uncontrolled resource consumption, resulting in resource exhaustion, denial of service (DoS), server un

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?` endpoint with `"fn_index":66`. This unrestricted server restart capability can severely disrupt service availability, cause data loss or co

Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js

Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py

ntlk unsafe deserialization vulnerability

pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint

vanna vulnerable to remote code execution caused by prompt injection

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions <= ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attackers to send crafted requests from the vulnerable server to internal or external resources, potential

litellm vulnerable to remote code execution based on using eval unsafely

Remote Code Execution via path traversal bypass in lollms

Apache Submarine Server Core Incorrect Authorization vulnerability

Apache Submarine Commons Utils has a hard-coded secret

parisneo/lollms Local File Inclusion (LFI) attack

Jupyter Server Proxy has a reflected XSS issue in host parameter

Langflow remote code execution vulnerability

ebookmeta XML External Entity vulnerability

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado

LoLLMS Path Traversal vulnerability

Authentication bypass in dtale

Remote code execution in mlflow

Remote code execution in pytorch lightning

A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secret

qdrant input validation failure

Vanna prompt injection code execution

Mocodo vulnerable to SQL injection in `/web/generate.php`

NASA AIT-Core vulnerable to remote code execution

NASA AIT-Core vulnerable to remote code execution

NASA AIT-Core vulnerable to remote code execution

NASA AIT-Core vulnerable to SQL Injection

PyMySQL SQL Injection vulnerability

litellm passes untrusted data to `eval` function without sanitization

ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command

LoLLMS Command Injection vulnerability

OctoPrint has an Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled

llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata

Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service

pywasm3 contains a global buffer overflow which leads to segmentation fault

pywasm3 contains a heap buffer overflow which leads to segmentation fault

CraftBeerPi 4 allows arbitrary code execution

lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.

python-jose algorithm confusion guard bypassed by DER-encoded public keys

changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

pyLoad allows upload to arbitrary folder lead to RCE