Advisory Catalog

Apache Airflow ODBC Provider Argument Injection vulnerability

jcvi vulnerable to Configuration Injection due to unsanitized user input

Apache Airflow vulnerable to exposure of sensitive information

Connection confusion in gRPC

gRPC Reachable Assertion issue

Snowflake Python Connector vulnerable to Command Injection

kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload

Reportlab vulnerable to remote code execution

Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration

Synapse Denial of service due to incorrect application of event authorization rules during state resolution

Synapse does not apply enough checks to servers requesting auth events of events in a room

Starlette has Path Traversal vulnerability in StaticFiles

Any file can be included with the pymdown-snippets extension

git-url-parse Regular Expression Denial of Service

Planet's secret file is created with excessive permissions

Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls

Vyper vulnerable to integer overflow in loop

mflow vulnerable to directory traversal

vyper vulnerable to storage allocator overflow

Apache Spark UI vulnerable to Command Injection

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

Relative path traversal in mlflow

Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-cont

Incorrect success value returned in vyper

modoboa vulnerable to Cross-Site Request Forgery

pretalx vulnerable to path traversal in HTML export

sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service

Mailman Core vulnerable to timing attacks

Flask-AppBuilder Has No Rate Limiting on Login AUTH DB

Apache Airflow Spark Provider vulnerable to improper input validation

Apache Airflow Drill Provider vulnerable to improper input validation

Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views

ADMesh improper array index validation

zstd vulnerable to buffer overrun

mindsdb arbitrary file write when extracting a remotely retrieved Tarball

Arbitrary file write in mindsdb when Extracting Tarballs retrieved from a remote location

Kiwi TCMS Stored Cross-site Scripting via SVG file

redis-py Race Condition due to incomplete fix

Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/

TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch

TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

TensorFlow vulnerable to integer overflow in EditDistance

TensorFlow has Null Pointer Error in TensorArrayConcatV2

TensorFlow has Null Pointer Error in SparseSparseMaximum

TensorFlow has Floating Point Exception in AudioSpectrogram

TensorFlow vulnerable to segfault when opening multiframe gif

TensorFlow has Floating Point Exception in AvgPoolGrad with XLA

TensorFlow has Null Pointer Error in QuantizedMatMulWithBiasAndDequantize

TensorFlow has segmentation fault in tfg-translate

TensorFlow has Null Pointer Error in LookupTableImportV2