Advisory Catalog

Apache Airflow MySQL Provider is Vulnerable to SQL Injection

After the owner removed the project from PyPI, another user uploaded a new version with non-working code

PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash

A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to he

Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations

Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`

Qiskit allows arbitrary code execution decoding QPY format versions < 13

XPixelGroup BasicSR Command Injection

Azure PromptFlow remote code execution related to Jinja templates

Arbitrary Code Execution via Crafted Keras Config for Model Loading

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attac

PlotAI eval vulnerability

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remo

PyTorch: Manipulation of the argument scale/zero_point leads to improper initialization via Quantized Sigmoid Module

PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument

Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch

Zip Exploit Crashes Picklescan But Not PyTorch

Django Vulnerable to Allocation of Resources Without Limits or Throttling

ray vulnerable to Insertion of Sensitive Information into Log File

Spacy-LLM Server-Side Template Injection (SSTI) vulnerability

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

dmlc/dgl Vulnerable to Remote Code Execution by Pickle Deserialization via rpc.recv_request()

Rembg allows SSRF via /api/remove

Rembg CORS misconfiguration

Flask-AppBuilder Observable Response Discrepancy