Advisory Catalog

vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store

Langroid has a Code Injection vulnerability in TableChatAgent

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype poll

Hugging Face Transformers Regular Expression Denial of Service

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Flask-AppBuilder open redirect vulnerability using HTTP host injection

Ollama Server Vulnerable to Denial of Service (DoS) Attack

Tornado vulnerable to excessive logging caused by malformed multipart form data

Vyper's `slice()` may elide side-effects when output length is 0

Vyper's `concat()` builtin may elide side-effects for zero-length arguments

Reflex vulnerable to private state fields modification

label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution

Apache IoTDB Discloses Sensitive Information via Log Files

Apache IoTDB Vulnerable to Remote Code Execution

Flask uses fallback key instead of current signing key

Apache Superset Allows Ownership Takeover