Advisory Catalog

vLLM is vulnerable to timing attack at bearer auth

LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing

python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments

Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion

clearml is vulnerable to Path Traversal through its `safe_extract` function

ZenML is vulnerable to Path Traversal through its `PathMaterializer` class

A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipulation can lead to heap-based buffer overflow. The attack needs to be launched locally. The exploit ha

A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/include/openddlparser/OpenDDLParserUtils.h. Such manipulation leads to heap-based buffer overflow. The att

A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation causes allocation of resources. The attack is restricted to local execution. The exploit has been publi

NiceGUI has a Reflected XSS

motionEye vulnerable to RCE via unsanitized motion config parameter

DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables

Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS is not set. An attacker can craft a URL on the legitimate domain that redirects a victim to an attacke

marimo vulnerable to proxy abuse of /mpl/{port}/

Django vulnerable to partial directory traversal via archives

Django vulnerable to SQL injection in column aliases

SPDK is vulnerable to buffer overflow in the NVMe-oF target component

Apache Pyfory python is vulnerable to deserialization of untrusted data

mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders

llama-index-core insecurely handles temporary files

JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

Apache Airflow: Connection sensitive details exposed to users with READ permissions

Open Babel has out-of-bounds read in PQS lowerit (pre-buffer read)

Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines

Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies

Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles

Open Babel has out-of-bounds write (overlapping memcpy) in zipstream basic_unzip_streambuf::underflow

Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule

An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor.