CVE-2024-8020

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

CVE-2024-12063

A Denial of Service DoS vulnerability exists in the file upload feature of imartinez/privategpt version v0.6.2. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large...

CVE-2024-10954

In the manim plugin of binary-husky/gptacademic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a proper sandbox. This allows an attacker to perform remote code...

CVE-2024-7034

Open WebUI open-webui has a documented vulnerability in version 0.3.8 where the /models/upload endpoint writes files arbitrarily due to using file_path = f"{UPLOAD_DIR}/{file.filename}" without input validation. This allows directory traversal via crafted file.filename to escape UPLOAD_DIR and ov...

Improper Handling of Exceptional Conditions

Overview llama-index-core is an Interface between LLMs and your data Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the streamcomplete method of the LangChainLLM class. An attacker can disrupt service availability by providing an input of type...

PT-2025-12149 · Unknown · Netease-Youdao/Qanything

Name of the Vulnerable Software and Affected Versions: netease-youdao/qanything version v2.0.0 Description: A Denial of Service DoS vulnerability exists in the file upload feature due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this ...

CVE-2025-30153 Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

Amazon Linux AMI : emacs (ALAS-2025-1964)

The version of emacs installed on the remote host is prior to 24.3-20.26. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1964 advisory. A flaw was found in the Emacs text editor. Improper handling of custom man URI schemes allows attackers to execute arbitrary shell...

The vulnerability of Zoom’s video conferencing software, related to improper handling of user actions, allows attackers to disclose sensitive information.

The vulnerability of Zoom video conferencing software is related to improper handling of user actions. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Server-Side Request Forgery (SSRF)

Axios is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper handling of absolute URLs, which causes axios to send requests directly to the specified absolute URL instead of respecting the baseURL, potentially leading to SSRF and exposing sensitive credentials...

Fortinet FortiWeb Web application firewall rules bypass by using an empty filename (FG-IR-23-115)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-23-115 advisory. - Two improper handling of syntactically invalid structure vulnerabilities CWE-228 in FortiWeb may allowan...

Linux Distros Unpatched Vulnerability : CVE-2021-22543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Linux: KVM through Improper handling of VMIO|VMPFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still...

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling...

zz 代码问题漏洞

zz is an e-commerce platform for zj1983 individual developers. A code issue vulnerability exists in zz 2024-8 and prior versions, which stems from improper handling of the url parameter in the HTTP request handling component, leading to server-side request forgery...

Incorrect Calculation

Vyper is vulnerable to Incorrect Calculation. The vulnerability is due to improper handling of oscillating final states due to the sqrt builtin incorrectly rounding up results when using the Babylonian method for square root calculation...

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in its improper handling of insufficient permissions or privileges, allowing a malicious actor to trigger a service failure.

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in the improper handling of insufficient permissions or privileges. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

Cross-site Scripting (XSS)

leantime/leantime is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper handling of SVG uploads which allows an attacker to inject malicious scripts and potentially redirect users to malicious websites by uploading specially crafted SVG files...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not properly handling queue merges that have been set up...

Tenda AC18 Stack Overflow Vulnerability

Tenda AC18 is a wireless router manufactured by Tenda. A stack overflow vulnerability exists in the formSetSafeWanWebMan function in Tenda AC18 version V15.03.05.05, which stems from improper handling of the remoteIp parameter. An attacker can exploit this vulnerability to remotely execute...

CVE-2023-20582

Improper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry PTE faults to bypass RMP checks in SEV-SNP, potentially leading to a loss of guest memory integrity...