Advisory Catalog

Keras code injection vulnerability

llama-index-core Command Injection vulnerability

mlflow vulnerable to Path Traversal

Insecure deserialization in BentoML

Directory traversal in zenml

OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack

Transformers Deserialization of Untrusted Data vulnerability

llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution

LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint

Aim Web API vulnerable to Remote Code Execution

Gradio allows users to access arbitrary files

yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)

pgAdmin Remote Code Execution (RCE) vulnerability

aliyundrive-webdav vulnerable to Command Injection

Lektor does not sanitize database path traversal

GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

Jupyter Server Proxy's Websocket Proxying does not require authentication

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file.

pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user

PaddlePaddle Path Traversal vulnerability

PaddlePaddle vulnerable to remote code execution

A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It

Mezzanine allows attackers to bypass access controls via manipulating the Host header

Mezzanine allows attackers to bypass access control mechanisms

Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID

LangChain Experimental vulnerable to arbitrary code execution

pretix mishandles file validation

Cross-site Scripting in MLFlow

MLFlow Cross-site Scripting vulnerability leads to client-side Remote Code Execution

Onnx Out-of-bounds Read vulnerability

pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string

Improper Certificate Validation in apache airflow mongo hook

DIRAC's TokenManager does not check permissions on cached tokens

Vyper negative array index bounds checks

SQLAlchemyDA unauthenticated arbitrary SQL query execution

Gradio Path Traversal vulnerability

Vyper's bounds check on built-in `slice()` function can be overflowed

vantage6 has insecure SSH configuration for node and server containers

ai-flow Deserialization of Untrusted Data vulnerability

Deserialization of untrusted data in synthcity

Whoogle Search Path Traversal vulnerability

Whoogle Search Server-Side Request Forgery vulnerability

Cross-site Scripting in Apache superset

Code execution in pandasai

SQL injection in llama-index

Unsafe yaml deserialization in llama-hub

Code execution in Embedchain

Code Injection in paddlepaddle

Arbitrary Code Execution in Pillow

concat built-in can corrupt memory in vyper