Advisory Catalog

sniff_csv provides filesystem access even when enable_external_access is disabled in duckdb

OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

Sentry vulnerable to stored Cross-Site Scripting (XSS)

ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command

Ankitects Anki LaTeX Blocklist Bypass vulnerability

Anki Latex Incomplete Blocklist Vulnerability

Ankitects Anki arbitrary script execution vulnerability

Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference

LoLLMS vulnerable to Expected Behavior Violation

Calibre-Web Cross Site Scripting (XSS)

[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`

TorchServe gRPC Port Exposure

TorchServe vulnerable to bypass of allowed_urls configuration

Sentry's Python SDK unintentionally exposes environment variables to subprocesses

Roundup Cross-site Scripting Vulnerability

Roundup Cross-site Scripting Vulnerability

Roundup Cross-site Scripting Vulnerability

BlastRADIUS also affects eduMFA

Apache StreamPipes has potential remote code execution (RCE) via file upload

Apache StreamPipes potentially allows creation of multiple identical accounts

Apache StreamPipes has possibility of SSRF in pipeline element installation process

Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler

Apache Airflow Potential Cross-site Scripting Vulnerability

dbt has an implicit override for built-in materializations from installed packages

Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib

Fiona affected by CVE-2020-14152 related to madler-zlib

JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the templat

Apache Superset vulnerable to improper SQL authorization

OpaMiddleware does not filter HTTP OPTIONS requests

langchain-experimental vulnerable to Arbitrary Code Execution

setuptools vulnerable to Command Injection via package URL

Malware package cipherbcrypt

Local File Inclusion in Solara

Red-DiscordBot vulnerable to Incorrect Authorization in commands API

Wagtail regular expression denial-of-service via search query parsing

A Stored Cross-Site Scripting (XSS) vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser. Th

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to uncontrolled resource consumption, resulting in resource exhaustion, denial of service (DoS), server un

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?` endpoint with `"fn_index":66`. This unrestricted server restart capability can severely disrupt service availability, cause data loss or co