Advisory Catalog

protobuf affected by a JSON recursion depth bypass

Langflow affected by Remote Code Execution via validate_code() exec()

Moonraker affected by LDAP search filter injection

Sentencepiece has a a heap overflow issue

orjson does not limit recursion for deeply nested JSON documents

docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage

Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

pytest has vulnerable tmpdir handling

FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection

Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true

Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF metadata

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder

Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization

vLLM affected by RCE via auto_map dynamic module loading during model initialization

Chainlit contain a server-side request forgery (SSRF) vulnerability

Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element id

Swing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user

ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion

ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect