Advisory Catalog

hnswlib Double Free vulnerability

PyPDF2 quadratic runtime with malformed PDF missing xref marker

PyPDF2 vulnerable to possible Infinite Loop when reading malformed objects

pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products).

requests-xml XML External Entity Injection vulnerability

py-xml XML External Entity Injection vulnerability

easy-parse XML External Entity Injection vulnerability

SafeURL-Python's hostname blocklist does not block FQDNs

Apache Airflow JDBC Provider Improper Input Validation vulnerability

pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character

Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

Apache Airflow ODBC Provider Argument Injection vulnerability

fief-server Server-Side Template Injection vulnerability

jcvi vulnerable to Configuration Injection due to unsanitized user input

Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error

Langchain vulnerable to arbitrary code execution

Apache Airflow vulnerable to exposure of sensitive information

Langchain OS Command Injection vulnerability

gRPC connection termination issue

Connection confusion in gRPC

gRPC Reachable Assertion issue

Snowflake Python Connector vulnerable to Command Injection

Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs

kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload

Synapse has URL deny list bypass via oEmbed and image URLs when generating previews

Synapse has improper checks for deactivated users during login

Reportlab vulnerable to remote code execution

Vulnerable OpenSSL included in cryptography wheels

Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration

MindSpore vulnerable to memory corruption

Open redirect in Tornado

toui allows user-specific variables to be shared between users

Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Ckan remote code execution and private information access via crafted resource ids

Synapse Denial of service due to incorrect application of event authorization rules during state resolution

Synapse does not apply enough checks to servers requesting auth events of events in a room

Unintended leak of Proxy-Authorization header in requests

Incorrect signature verification in django-ses