Advisory Catalog

PyMongo Out-of-bounds Read in the bson module

Skops unsafe deserialization

ydata unsafe deserialization

ydata cross-site scripting

ydata unsafe deserialization

MLFlow improper input validation

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

ansibleguy-webui Cross-site Scripting vulnerability

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionality, an authenticated attacker with low privileges can gain administrative privileges on the web appli

NASA AIT-Core uses unencrypted channels to exchange data over the network

joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content.

A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to improper input validation when handling file paths during the chat history upload process. An attacker ca

RunGptLLM class in LlamaIndex has a command injection

MLflow has a Local File Read/Path Traversal bypass

Scrapy leaks the authorization header on same-domain but cross-origin redirects

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platforms/app/main.c.

Arbitrary HTML present after sanitization because of unicode normalization

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

Litestar and Starlite vulnerable to Path Traversal

WordOps has TOCTOU race condition

Gradio allows credential leakage on Windows

Ryu Infinite Loop vulnerability

Ryu Infinite Loop vulnerability

Ryu Infinite Loop vulnerability

Ryu Infinite Loop vulnerability

Ryu Infinite Loop vulnerability

sagemaker-python-sdk Command Injection vulnerability

sagemaker-python-sdk vulnerable to Deserialization of Untrusted Data

pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload

pgAdmin is affected by a multi-factor authentication bypass vulnerability

aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

nautobot has reflected Cross-site Scripting potential in all object list views

lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp.

PyPXE Buffer Overflow vulnerability

dbt uses a SQLparse version with a high vulnerability

OpenStack Storlets arbitrary code execution vulnerability

Sentry vulnerable to leaking superuser cleartext password in logs

PyTorch heap buffer overflow vulnerability

Pytorch use-after-free vulnerability

langchain vulnerable to path traversal

mlflow vulnerable to Path Traversal