Advisory Catalog

Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking

Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store

Hugging Face Transformers Regular Expression Denial of Service

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and spoofing a service. This is due to improper validation of array index access when downloading a model via the /api/pull endpoint, which can le

Tornado vulnerable to excessive logging caused by malformed multipart form data

Reflex vulnerable to private state fields modification

label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution

Apache IoTDB Discloses Sensitive Information via Log Files

LlamaIndex Vulnerable to Denial of Service (DoS)

Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration

FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. An HTTP header injection vulnerability has been identified in versions prior to 2.0.0. By manipulating the X-Forwarded-For header, an attacker can potentially injec

Langroid Allows XXE Injection via XMLToolMessage

Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

vLLM: Quadratic Time Complexity in Input Token Processing​ leads to denial of service

Data exposure via ZeroMQ on multi-node vLLM deployment

LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py

youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext

Picklescan missing detection when calling built-in python library function timeit.timeit()

Picklescan failed to detect to some unsafe global function in Numpy library

Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate

Apache Airflow Common SQL Provider Vulnerable to SQL Injection

jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

Django Potential Denial of Service (DoS) on Windows

Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks

Synapse vulnerable to federation denial of service via malformed events

Frappe vulnerable to information disclosure leading to account takeover

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability

Open WebUI stored cross-site scripting (XSS) vulnerability

Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

Open WebUI Vulnerable to a Session Fixation Attack

Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file

Open WebUI Uncontrolled Resource Consumption vulnerability

Open WebUI has vulnerable dependency on starlette via fastapi

Open WebUI Uncontrolled Resource Consumption vulnerability

Open WebUI Uncontrolled Resource Consumption vulnerability

BentoML vulnerable to Uncontrolled Resource Consumption

MLflow Cross-Site Request Forgery (CSRF) vulnerability

LiteLLM Has an Improper Authorization Vulnerability

MLflow Uncontrolled Resource Consumption vulnerability

LiteLLM Has a Leakage of Langfuse API Keys

Aim Excessive Data Query Operations in a Large Data Table vulnerability

Aim Uncontrolled Resource Consumption vulnerability

LiteLLM Reveals Portion of API Key via a Logging File

ZenML unauthenticated DoS via Multipart Boundry