Advisory Catalog

lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()

Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE

Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the ta

Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vuln

Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the targ

Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the targe

Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target

Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th

Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerabilit

Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

Home Assistant Core before is vulnerable to Directory Traversal

Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Marshmallow has DoS in Schema.load(many)

Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification

FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

External Control of File Name or Path in Langflow

Langflow vulnerable to Server-Side Request Forgery

pretix has Broken Access Control Allowing Cross-User File Access via UUID

pretix has Broken Access Control Allowing Cross-User File Access via UUID

FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation

Weblate is vulnerable to RCE through Git config file overwrite

Weblate has an arbitrary file read via symbolic links

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous ac

Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez

mcp-server-git has missing path validation when using --repository flag

mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows