Advisory Catalog

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

OctoPrint vulnerable to possible file extraction via upload endpoints

Requests vulnerable to .netrc credentials leak via malicious URLs

Django Improper Output Neutralization for Logs vulnerability

SignXML's signature verification with HMAC is vulnerable to a timing attack

SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

django-helpdesk Allows Sensitive Data Exposure

Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

Gradio CORS Origin Validation Bypass Vulnerability

multicast in source builds from vulnerable setuptools dependency

vLLM Tool Schema allows DoS via Malformed pattern and type Fields

vLLM allows clients to crash the openai server with invalid regex

vLLM DOS: Remotely kill vllm over http with invalid JSON schema

vLLM vulnerable to Regular Expression Denial of Service

vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`

pypickle Incorrect Privilege Assignment vulnerability

HumanSignal label-studio-ml-backend Deserialization of Untrusted Data vulnerability

pypickle unsafe deserialization vulnerability

A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The attac

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking

docarray prototype pollution

FunAudioLLM InspireMusic deserialization vulnerability

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype poll

Flask-AppBuilder open redirect vulnerability using HTTP host injection

Apache Superset Allows Ownership Takeover

Django has a denial-of-service possibility in strip_tags()

Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack

Open WebUI allows limited stored XSS vila uploaded html file

Mezzanine CMS Cross-Site Scripting (XSS) vulnerability

OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the `external` flag on/off and change

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

OctoPrint Authenticated Reverse Proxy Page Authentication Bypass

Rasa Pro Missing Authentication For Voice Connector APIs

PyTorch Improper Resource Shutdown or Release vulnerability

vLLM vulnerable to Denial of Service by abusing xgrammar cache

xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in memory

Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialReference::Release function. NOTE: the Supplier indicates that the report is invalid and could not be reproduced.

InternLM LMDeploy code injection vulnerability

LMDeploy Improper Input Validation Vulnerability

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds read.

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buffer

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.caching_allocator_delete of the file c10/cuda/CUDACachingAllocator.cpp. The manipulation leads to memory corruption. An attack has to be approached locally. The ex

A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jit_module_from_flatbuffer. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mW

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to