Advisory Catalog

Cross-site Scripting in Pyhtml2pdf

Potential buffer overflow in CBOR2 decoder

Scrapy decompression bomb vulnerability

Scrapy authorization header leakage on cross-domain redirect

Scrapy vulnerable to ReDoS via XMLFeedSpider

Kinto Attachment's attachments can be replaced on read-only records

Django denial-of-service attack in the intcomma template filter

Allegro AI ClearML path traversal vulnerability

Allegro AI ClearML vulnerable to deserialization of untrusted data

Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

Python Cryptography package vulnerable to Bleichenbacher timing oracle attack

m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657

python-multipart vulnerable to Content-Type Header ReDoS

vantage6 remote code execution vulnerability

aiohttp is vulnerable to directory traversal

A vulnerability classified as critical was found in van_der_Schaar LAB TemporAI 0.0.3. Affected by this vulnerability is the function load_from_file of the component PKL File Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to th

Apache Airflow: pickle deserialization vulnerability in XComs

Apache Airflow: Bypass permission verification to read code of other dags

Cross-site Scripting Vulnerability on Avatar Upload

XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Minerva timing attack on P-256 in python-ecdsa

Code execution in metagpt

ReDoS in Embedchain

JupyterLab vulnerable to potential authentication and CSRF tokens leak

Cross-Frame Scripting vulnerability has been found on Plone CMS

Path traversal in flaskcode

Path traversal in flaskcode

Untrusted search path under some conditions on Windows allows arbitrary code execution

fonttools XML External Entity Injection (XXE) Vulnerability

pyload Unauthenticated Flask Configuration Leakage vulnerability

D-Tale server-side request forgery through Web uploads

PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption

PaddlePaddle floating point exception in paddle.nanmedian

PaddlePaddle floating point exception in paddle.linalg.matrix_rank

PaddlePaddle segfault in paddle.dot

PaddlePaddle floating point exception in paddle.linalg.eig

PaddlePaddle segfault in paddle.mode

PaddlePaddle null pointer dereference in paddle.nextafter

PaddlePaddle segfault in paddle.put_along_axis

PaddlePaddle floating point exception in paddle.topk

PaddlePaddle floating point exception in paddle.lerp

PaddlePaddle floating point exception in paddle.amin

PaddlePaddle nullptr dereference in paddle.crop

PaddlePaddle floating point exception in paddle.argmin and paddle.argmax

Gradio makes the `/file` secure against file traversal and server-side request forgery attacks

transformers has a Deserialization of Untrusted Data vulnerability

MLflow Local File Disclosure Vulnerability

MLflow Path Traversal Vulnerability

Expired tokens can be renewed without validating the account password

Apache Superset SQL injection vulnerability