Advisory Catalog

LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection

InvokeAI Deserialization of Untrusted Data vulnerability

FastChat Server-Side Request Forgery vulnerability

Feast Cross-Origin Resource Sharing vulnerability

InvokeAI Uncontrolled Resource Consumption vulnerability

InvokeAI Arbitrary File Deletion vulnerability

vLLM Deserialization of Untrusted Data vulnerability

A Regular Expression Denial of Service (ReDoS) vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern `r'<[^>]+>'` to parse user input. In Python's default regex engine, this pattern can take polynomial time to match certain crafted inputs. An att

langchain-core allows unauthorized users to read arbitrary files from the host file system

FastChat Denial of Service vulnerability

FastChat open redirect vulnerability

FastChat Uncontrolled Resource Consumption vulnerability

DB-GPT vulnerable to Cross-Site Request Forgery

DB-GPT vulnerable to Arbitrary File Upload with Path Traversal

DB-GPT Arbitrary File Write vulnerability

DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users

DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload

DB-GPT Absolute Path Traversal vulnerability

DB-GPT Path Traversal vulnerability

DB-GPT Uncontrolled Resource Consumption vulnerability

InvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`

HyperLPR Denial of Service vulnerability

gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnerability allows unauthenticated users to access arbitrary files on the server by uploading a specially

An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multipart boundary. Although a patch was applied for CVE-2024-7807, the issue can still be exploited by sending data in groups w

Gradio Vulnerable to Arbitrary File Deletion

Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

H2O Vulnerable to Denial of Service (DoS) and File Write

Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb

H2O Deserialization of Untrusted Data Vulnerability

H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint

H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint

Horovod Vulnerable to Command Injection

LiteLLM Vulnerable to Denial of Service (DoS)

Aim Vulnerable to Denial of Service (DoS)

vLLM Allows Remote Code Execution via Mooncake Integration

vLLM denial of service via outlines unbounded cache on disk