Advisory Catalog

Sentry: Improper authentication on SAML SSO process allows user identity linking

Apache Airflow error reporting may expose full kwargs

MLflow Use of Default Password Authentication Bypass Vulnerability

MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability

Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)

Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming

Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)

Fickling has a detection bypass via stdlib network-protocol constructors

Flask session does not add `Vary: Cookie` header when accessed in some ways

Werkzeug safe_join() allows Windows special device names

D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

Open WebUI vulnerable to Stored XSS via iFrame in citations model

Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

changedetection.io is vulnerable to unauthenticated static path traversal

Open Babel has NULL pointer dereference in MOL2 OBAtom::SetFormalCharge

Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString

pypdf possibly has long runtimes for malformed FlateDecode streams

pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

pypdf has a possible infinite loop when processing TreeObject

OpenStack Nova calls qemu-img without format restrictions for resize

NLTK has a Zip Slip Vulnerability

Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER

Hugging Face Smolagents has a Server-Side Request Forgery issue

NVIDIA NeMo Framework Deserializes Untrusted Data

NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution

A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stl_check_normal_vector of the file src/normals.c. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the pub

Skill-scanner Unsecured Network Binding Vulnerability

Indico Affected by Cross-Site-Scripting via material uploads

Indico has Server-Side Request Forgery (SSRF) in multiple places

Weblate has an argument injection in management console

Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering