Advisory Catalog

onnx allows Arbitrary File Overwrite in download_model_with_test_data

Arbitrary system path lookup in h20

SQL injection in litellm

SQL injection in litellm

Arbitrary file deletion in litellm

LoLLMS Path Traversal vulnerability

Authentication bypass in dtale

LoLLMS Path Traversal vulnerability

scikit-learn sensitive data leakage vulnerability

Undefined Behavior in mlflow

Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever

Local File Inclusion in mlflow

Clickjacking in zenml

Improper authorization in zenml

Cross site scripting in zenml

Improper authentication in zenml

Remote code execution in mlflow

Race condition in zenml

Denial of service in langchain-community

Remote code execution in pytorch lightning

Server-Side Request Forgery in gradio

Local file inclusion in gradio

Jupyter server on Windows discloses Windows user password hash

Observable Timing Discrepancy in pypqc

PyMongo Out-of-bounds Read in the bson module

Arbitrary JavaScript execution due to using outdated libraries

Skops unsafe deserialization

ydata unsafe deserialization

ydata cross-site scripting

ydata unsafe deserialization

MLFlow improper input validation

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secret

qdrant input validation failure

Slack integration leaks sensitive information in logs

Vanna prompt injection code execution