Advisory Catalog

tqdm CLI arguments injection attack

changedetection.io Cross-site Scripting vulnerability

lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.

lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0.

lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h.

dcnnt-py is vulnerable to command injection via Notification Handler

python-jose denial of service via compressed JWE content

vyper default functions don't respect nonreentrancy keys

vyper performs multiple eval of `sqrt()` argument built in

vyper performs incorrect topic logging in raw_log

vyper performs double eval of the slice start/length args in certain cases

vyper performs double eval of raw_args in create_from_blueprint

vyper's range(start, start + N) reverts for negative numbers

social-auth-app-django affected by Improper Handling of Case Sensitivity

Synapse V2 state resolution weakness allows Denial of Service (DoS)

cg vulnerable to an Open Redirect Vulnerability on Referer Header

Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.

flask-cors vulnerable to log injection when the log level is set to debug

aiohttp Cross-site Scripting vulnerability on index pages for static file handling

Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

Cross-site Scripting (XSS) in mindsdb/mindsdb

zenml Session Fixation vulnerability

gradio Server-Side Request Forgery vulnerability

wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. This vulnerabili

Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check

Saleor: Customers' addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method

GeoNode: Stored XSS to full account takeover

Apache Airflow Improper Preservation of Permissions vulnerability

LangChain's XMLOutputParser vulnerable to XML Entity Expansion

Unauthenticated views may expose information to anonymous users

Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files

Black vulnerable to Regular Expression Denial of Service (ReDoS)

XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

Information leakage in YAQL

Improper Privilege Management in djangorestframework-simplejwt

Regular expression denial-of-service in Django

vantage6 vulnerable to a username timing attack on recover password/MFA token

vantage6's CORS settings overly permissive

Potential log injection in reset user endpoint in CKAN

aiosmtpd vulnerable to SMTP smuggling

LibOSDP RMAC revert to the beginning of the session

LibOSDP vulnerable to a null pointer deref in osdp_reply_name

Django MarkdownX Cross-Site Scripting (XSS) vulnerability

JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

eth-abi is vulnerable to recursive DoS

Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users

Docassemble HTML and javascript injection

Docassemble open redirect

Apache Airflow: DAG Code and Import Error Permissions Ignored

Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)