Advisory Catalog

LlamaIndex Improper Handling of Exceptional Conditions vulnerability

FastChat Server-Side Request Forgery vulnerability

GluonCV Arbitrary File Write via TarSlip

Kedro allows Remote Code Execution by Pulling Micro Packages

FastChat Server-Side Request Forgery vulnerability

Feast Cross-Origin Resource Sharing vulnerability

InvokeAI Uncontrolled Resource Consumption vulnerability

FastChat Denial of Service vulnerability

FastChat Uncontrolled Resource Consumption vulnerability

DB-GPT vulnerable to Cross-Site Request Forgery

DB-GPT Path Traversal vulnerability

DB-GPT Uncontrolled Resource Consumption vulnerability

InvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`

HyperLPR Denial of Service vulnerability

An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multipart boundary. Although a patch was applied for CVE-2024-7807, the issue can still be exploited by sending data in groups w

Gradio Vulnerable to Arbitrary File Deletion

Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

H2O Vulnerable to Denial of Service (DoS) and File Write

Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb

H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint

H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint

LiteLLM Vulnerable to Denial of Service (DoS)

Aim Vulnerable to Denial of Service (DoS)

Nuxt allows DOS via cache poisoning with payload rendering response

Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability

jsPDF Bypass Regular Expression Denial of Service (ReDoS)

TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function

Memory Exhaustion in Expr Parser with Unrestricted Input

Openshift Hive Exposes VCenter Credentials via ClusterProvision

PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash

tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability

Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

In Azle, calling `setTimer` causes infinite loop of timers

Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses

Cosmos SDK: x/group can halt when erroring in EndBlocker

Prototype Pollution Vulnerability in parse-git-config

Out-of-bounds Read in Ruby JSON Parser

Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover

The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability

Microsoft Windows Win32k Use-After-Free Vulnerability

Mockoon has a Path Traversal and LFI in the static file serving endpoint

Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries

FreeType Out-of-Bounds Write Vulnerability

Arbitrary Code Execution via Crafted Keras Config for Model Loading

Vela Server Has Insufficient Webhook Payload Data Verification

Local File Inclusion in Rack::Static