Advisory Catalog

Heap-based Buffer Overflow in sqlite-vec

Cross-Site Request Forgery (CSRF) in strawberry-graphql

OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain information about the password hash using a timing attack.

OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.

OAuth2 client ID and secret exposed through the web browser

Mesop has a local file Inclusion via static file serving functionality

Guardrails has an arbitrary code execution vulnerability

Sentry improperly authorizes muting of alert rules

Sentry improperly authorizes deletion of user issue alert notifications

vLLM denial of service vulnerability

LangChain pickle deserialization of untrusted data

Ansible vulnerable to Insertion of Sensitive Information into Log File

LiteLLM Server-Side Request Forgery (SSRF) vulnerability

Cleanlab Deserialization of Untrusted Data vulnerability

MindsDB Eval Injection vulnerability

Refuel Autolab Eval Injection vulnerability

Refuel Autolab Eval Injection vulnerability

MindsDB Eval Injection vulnerability

MindsDB Eval Injection vulnerability

MindsDB Eval Injection vulnerability

MindsDB Eval Injection vulnerability

MindsDB Eval Injection vulnerability

MindsDB Deserialization of Untrusted Data vulnerability

MindsDB Deserialization of Untrusted Data vulnerability

MindsDB Deserialization of Untrusted Data vulnerability

MindsDB Deserialization of Untrusted Data vulnerability

Apache Airflow vulnerable to Improper Encoding or Escaping of Output

Apache Airflow vulnerable to Execution with Unnecessary Privileges

Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

`spam` project on PyPI compromised, malicious releases made

opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

opencv-contrib-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

opencv-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

gratient 0.5 contains credential harvesting code

`exotel` project on PyPI compromised, malicious release made

HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

Taipy 3.1.1 affected by CVEs on flask-core and pymongo

Mage AI incorrectly gives privileges to users with deleted accounts

pretix Stored Cross-site Scripting vulnerability

LF Edge eKuiper has a SQL Injection in sqlKvStore

Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow

JupyterHub has a privilege escalation vulnerability with the `admin:users` scope

Pulp incorrectly assigns RBAC permissions in tasks that create objects

Django memory consumption vulnerability

Django vulnerable to a denial-of-service attack

Django vulnerable to denial-of-service attack

Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

Weave server API vulnerable to arbitrary file leak