Advisory Catalog

TensorFlow has segfault in array_ops.upper_bound

twisted.web has disordered HTTP pipeline response

sniff_csv provides filesystem access even when enable_external_access is disabled in duckdb

Sentry vulnerable to stored Cross-Site Scripting (XSS)

Ankitects Anki arbitrary script execution vulnerability

Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference

LoLLMS vulnerable to Expected Behavior Violation

TorchServe gRPC Port Exposure

Apache StreamPipes has potential remote code execution (RCE) via file upload

Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler

dbt has an implicit override for built-in materializations from installed packages

Fiona affected by CVE-2020-14152 related to madler-zlib

setuptools vulnerable to Command Injection via package URL

Malware package cipherbcrypt

Local File Inclusion in Solara

Wagtail regular expression denial-of-service via search query parsing

Django vulnerable to Denial of Service

Django Path Traversal vulnerability

Django vulnerable to Denial of Service

Aim denial of service vulnerability

Vanna vulnerable to SQL Injection

Certifi removes GLOBALTRUST root certificate

OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access

yt-dlp File system modification and RCE through improper file-extension sanitization

lollms vulnerable to dot-dot-slash path traversal in XTTS server

A path traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410, allowing any user to delete other users' chat histories. This vulnerability can also be exploited to delete any files ending in `.json` on the target system, leading to a denial of service as users are unable to au

lollms vulnerable to path traversal due to unauthenticated root folder settings change

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the filter_history function within the utils.py module. This function takes a user-provided keyword and attempts to match it against chat history f

h2o vulnerable to unexpected POST request shutting down server

lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE

Path traversal in saltstack

pdoc embeds link to malicious CDN if math mode is enabled

js2py allows remote code execution

langchain_experimental Code Execution via Python REPL access

LNbits improperly handles potential network and payment failures when using Eclair backend

Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

Authlib has algorithm confusion with asymmetric public keys

zenml-io/zenml does not expire the session after password reset

ebookmeta XML External Entity vulnerability

onnx allows Arbitrary File Overwrite in download_model_with_test_data

SQL injection in litellm

Arbitrary file deletion in litellm

LoLLMS Path Traversal vulnerability

Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever

Local File Inclusion in mlflow

Server-Side Request Forgery in gradio

Local file inclusion in gradio

Jupyter server on Windows discloses Windows user password hash

Observable Timing Discrepancy in pypqc