Advisory Catalog

python-multipart vulnerable to Content-Type Header ReDoS

Vyper's external calls can overflow return data to return input buffer

Dash apps vulnerable to Cross-site Scripting

Vyper's bounds check on built-in `slice()` function can be overflowed

glance-store logs s3 access keys

OctoPrint Unverified Password Change via Access Control Settings

Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

Vyper's raw_call `value=` kwargs not disabled for static and delegate calls

vantage6 remote code execution vulnerability

vantage6 has insecure SSH configuration for node and server containers

vantage6 vulnerable to username timing attack

vantage6 may create unencrypted tasks in encrypted collaboration

DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature.

aiohttp is vulnerable to directory traversal

aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

ai-flow Deserialization of Untrusted Data vulnerability

Deserialization of untrusted data in synthcity

A vulnerability classified as critical was found in van_der_Schaar LAB TemporAI 0.0.3. Affected by this vulnerability is the function load_from_file of the component PKL File Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to th

Null pointer dereference in PKCS12 parsing

Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Apache Airflow: pickle deserialization vulnerability in XComs

Apache Airflow: Bypass permission verification to read code of other dags

Cross-site Scripting Vulnerability on Data Import

Cross-site Scripting Vulnerability on Avatar Upload

Whoogle Search Path Traversal vulnerability

Whoogle Search Path Traversal vulnerability

Whoogle Search Server-Side Request Forgery vulnerability

Whoogle Search Cross-site Scripting vulnerability

Cross-site Scripting in Apache superset

XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Minerva timing attack on P-256 in python-ecdsa

html injection vulnerability in the `tuitse_html` function.

Code execution in pandasai

Code execution in metagpt

SQL injection in llama-index

Unsafe yaml deserialization in llama-hub

Code execution in Embedchain

ReDoS in Embedchain

Code Injection in paddlepaddle

JupyterLab vulnerable to potential authentication and CSRF tokens leak

JupyterLab vulnerable to SXSS in Markdown Preview

Arbitrary Code Execution in Pillow

changedetection.io API endpoint is not secured with API token

concat built-in can corrupt memory in vyper

Unsecured endpoints in the jupyter-lsp server extension

Cross-Frame Scripting vulnerability has been found on Plone CMS

Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects

Privilege escalation for users that can access mock configuration

Remote Code Execution vulnerability in Apache IoTDB via UDF