Advisory Catalog

Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint

Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py

Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list

Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files

Gradio uses insecure communication between the FRP client and server

Gradio has a race condition in update_root_in_config may redirect user traffic

Gradio performs a non-constant-time comparison when comparing hashes

Gradio has several components with post-process steps allow arbitrary file leaks

Gradio lacks integrity checking on the downloaded FRP client

In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring

Gradio vulnerable to SSRF in the path parameter of /queue/join

Gradio has a one-level read path traversal in `/custom_component`

Gradio's CORS origin validation accepts the null origin

Gradio's `is_in_or_equal` function may be bypassed

Gradios's CORS origin validation is not performed when the request has a cookie

open-webui allows writing and deleting arbitrary files

open-webui Insecure Direct Object Reference (IDOR) vulnerability

Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a `wasmtime::Engine`'s internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potentially type registry corruption. That registry corruption coul

Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or prior. The runtime c

xhtml2pdf Denial of Service via crafted string

DeepSpeed Remote Code Execution Vulnerability

Django allows enumeration of user e-mail addresses

Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters

OpenStack Ironic fails to verify checksums of supplied image_source URLs