Advisory Catalog

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project w

Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the URL field. Attackers can paste a buffer of 5000 characters into the 'From URL' field during torrent addition to trigger an application crash.

Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Webseeds field. Attackers can paste a buffer of 5000 bytes into the Webseeds field during torrent creation to trigger an application crash.

MindSQL is vulnerable to Code Injection through its ask_db function

pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading

langflow has Unauthenticated IDOR on Image Downloads

pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root

NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version

Improper Authentication and Origin Validation Error in pyload-ng

Intake has a Command Injection via shell() Expansion in Parameter Defaults

Langflow has an Arbitrary File Write (RCE) via v2 API

Denial of service via non-terminating SYLT frame parsing loop in tinytag

ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor

PyMuPDF has a path traversal in _main_.py

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

Unauthenticated remote shutdown in nltk.app.wordnet_app

Arbitrary file write via tar traversal in mlflow

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk