Advisory Catalog

CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

OctoPrint Authenticated Reverse Proxy Page Authentication Bypass

youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

Crawl4AI SSRF vulnerability

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

Rasa Pro Missing Authentication For Voice Connector APIs

Pycel allows code injection via a crafted formula

PyTorch Improper Resource Shutdown or Release vulnerability

Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

vLLM vulnerable to Denial of Service by abusing xgrammar cache

VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3Importer::ValidateSurfaceHeaderOffsets of the file code/AssetLib/MD3/MD3Loader.cpp of the component File Handler. The manipulation leads to heap-based buffer ov

TigerVNC accessible via the network and not just via a UNIX socket as intended

xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in memory

BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialReference::Release function. NOTE: the Supplier indicates that the report is invalid and could not be reproduced.

Picklescan missing detection when calling built-in python library function timeit.timeit()

Picklescan failed to detect to some unsafe global function in Numpy library

Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate

Langflow Unauth RCE

Apache Airflow Common SQL Provider Vulnerable to SQL Injection

LNbits Lightning Network Payment System Vulnerable to Server-Side Request Forgery via LNURL Authentication Callback

BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler. The manipulation of the argument Name leads to

jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

InternLM LMDeploy code injection vulnerability

LMDeploy Improper Input Validation Vulnerability

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds read.

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buffer

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads

pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering

pgAdmin 4 Vulnerable to Remote Code Execution

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.caching_allocator_delete of the file c10/cuda/CUDACachingAllocator.cpp. The manipulation leads to memory corruption. An attack has to be approached locally. The ex

A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the function BinaryReaderInterp::BeginFunctionBody of the file src/interp/binary-reader-interp.cc. The manipulation leads to null pointer dereference. The attack can be launched remotely

A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jit_module_from_flatbuffer. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.