Advisory Catalog

Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints

Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`

path traversal vulnerability was identified in the parisneo/lollms-webui

code injection vulnerability exists in the huggingface/text-generation-inference repository

Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability

Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

ansibleguy-webui Cross-site Scripting vulnerability

dbt allows Binding to an Unrestricted IP Address via socketsocket

rockhopper Buffer Overflow vulnerability

Mocodo vulnerable to SQL injection in `/web/generate.php`

jupyter-scheduler's endpoint is missing authentication

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionality, an authenticated attacker with low privileges can gain administrative privileges on the web appli

vantage6 collaboration admins can extend their influence by expanding the collaboration

NASA AIT-Core uses unencrypted channels to exchange data over the network

NASA AIT-Core vulnerable to remote code execution

NASA AIT-Core vulnerable to remote code execution

NASA AIT-Core vulnerable to remote code execution

NASA AIT-Core vulnerable to SQL Injection

PyMySQL SQL Injection vulnerability

OMERO.web must check that the JSONP callback is a valid function

Requests `Session` object does not verify requests after making first request with verify=False

aiosmtpd STARTTLS unencrypted commands injection

litellm passes untrusted data to `eval` function without sanitization

joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content.

ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command

A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to improper input validation when handling file paths during the chat history upload process. An attacker ca

RunGptLLM class in LlamaIndex has a command injection

LoLLMS Command Injection vulnerability

MLflow has a Local File Read/Path Traversal bypass

MLflow allows low privilege users to delete any artifact

Scrapy allows redirect following in protocols other than HTTP

Scrapy's redirects ignoring scheme-specific proxy settings

Scrapy leaks the authorization header on same-domain but cross-origin redirects

OctoPrint has an Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled

Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata

Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service

Apache Superset Incorrect Authorization vulnerability

wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platforms/app/main.c.

pywasm3 contains a global buffer overflow which leads to segmentation fault

pywasm3 contains a heap buffer overflow which leads to segmentation fault

Arbitrary HTML present after sanitization because of unicode normalization

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

Litestar and Starlite vulnerable to Path Traversal

WordOps has TOCTOU race condition