Advisory Catalog

Vyper has a double eval in For List Iter

AugAssign evaluation order causing OOB write within the object in Vyper

vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache

Vyper Does Not Check the Success of Certain Precompile Calls

Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution

GHSL-2024-288: SickChill open redirect in login

sigstore has insufficient validation of integration timestamp during verification

Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API

Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list

In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring

Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a `wasmtime::Engine`'s internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potentially type registry corruption. That registry corruption coul

yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

Cross-site Scripting in djangorestframework

Improper authentication in zenml

Race condition in zenml

Arbitrary JavaScript execution due to using outdated libraries

Slack integration leaks sensitive information in logs

Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability

vantage6 collaboration admins can extend their influence by expanding the collaboration

LIEF obtain sensitive information via the name parameter

Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

Improper Certificate Validation vulnerability in Apache Airflow FTP Provider

Dynamic Variable Evaluation in qiskit-ibm-runtime

fgr Vulnerable to Insecure Default Variable Initialization

PyPop C extensions possible vulnerability: missing arguments and redundant null pointers

tuf's Metadata API: Targets.get_delegated_role() is missing input validation

commonground-api-common unexploitable privilege escalation in JWT authentication middleware

vantage6 vulnerable to username timing attack

changedetection.io API endpoint is not secured with API token

cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code

dbt-core's secret env vars written to package-lock.json in plaintext

Wagtail vulnerable to disclosure of user names via admin bulk action views

matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes

plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait

Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include vulnerable OpenSSL

SafeURL-Python's hostname blocklist does not block FQDNs

Vulnerable OpenSSL included in cryptography wheels

OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability

Incorrect parsing of nameless cookies leads to __Host- cookies bypass

Package discontinued because Bitly lowered the free quota

Temporary File Information Disclosure vulnerability in MPXJ

`CHECK` failure in `SobolSample` via missing validation

`CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in eager mode

Python-TUF vulnerable to incorrect threshold signature computation for new root metadata

OpenStack Nova Changing vnic_type breaks compute service restart

Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings

SaltStack Salt Improper Authentication via Man in the Middle Attack

Infinite loop in Pillow