3m (>=0.1.0, <=0.1.3), aap-llamaindex (>=0.1.1.dev1, <=0.2.0) +354 more potentially affected by CVE-2024-58339 via llama-index (>=0.4.17, <=0.14.23)

llama-index PYPI version =0.4.17, =0.1.0, =0.1.1.dev1, =0.1.8, =0.0.2, =1.1.0a20250502, =0.10.0, =1.4.3, =0.1.0a0.dev0, =0.2.0a0, =0.1.0, =0.1.0a1, =1.0.1 and more Source cves: CVE-2024-58339 Source advisory: SNYK:PYTHON-LLAMAINDEX-14917160...

PYSEC-2026-85

LlamaIndex run-llama/llamaindex versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.loadfromdisk in llamaindex/indices/managed/bgem3/base.py. The function uses pickle.load to deserialize multiembedstore.pkl from a user-supplied persistdir without...

CVE-2024-58339

LlamaIndex run-llama/llamaindex versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The customquery logic generates SQL statements from a user-supplied prompt and executes them via vn.runsql without...

CVE-2021-41074

A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document...

CVE-2021-41074

A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document...

EUVD-2026-1961

Malicious code in graponater PyPI...

QloApps 安全漏洞

QloApps is a hotel management and reservation system from QloApps open source. A security vulnerability exists in QloApps version 1.5.1, which stems from a cross-site request forgery issue in index.php that could allow an attacker to change the administrator's email address via a specially crafte...

PT-2026-2299

Name of the Vulnerable Software and Affected Versions QloApps hotel eCommerce version 1.5.1 Description A Cross-Site Request Forgery CSRF issue exists in the index.php file. This allows an attacker to modify the administrator's email address by leveraging a malicious HTML document. Recommendation...

CVE-2026-0843

A vulnerability has been found in jiujiujia/victor123/wxw850227 jjjfood and jjjshopfood up to 20260103. This vulnerability affects unknown code of the file /index.php/api/product.category/index. Such manipulation of the argument latitude leads to sql injection. The attack can be launched remotely...

CVE-2026-0843 jiujiujia/victor123/wxw850227 jjjfood/jjjshop_food index sql injection

A vulnerability has been found in jiujiujia/victor123/wxw850227 jjjfood and jjjshopfood up to 20260103. This vulnerability affects unknown code of the file /index.php/api/product.category/index. Such manipulation of the argument latitude leads to sql injection. The attack can be launched remotely...

CVE-2026-0843 jiujiujia/victor123/wxw850227 jjjfood/jjjshop_food index sql injection

A vulnerability has been found in jiujiujia/victor123/wxw850227 jjjfood and jjjshopfood up to 20260103. This vulnerability affects unknown code of the file /index.php/api/product.category/index. Such manipulation of the argument latitude leads to sql injection. The attack can be launched remotely...

CVE-2026-0843

The CVE-2026-0843 entry applies to jjjfood and jjjshop_food (up to 20260103) from jiujiujia/victor123/wxw850227, with a SQL injection in /index.php/api/product.category/index. The root cause is manipulation of the latitude parameter enabling remote exploitation. Public disclosures exist and explo...

EUVD-2026-1910

Malicious code in libc-dev PyPI...

CHASE: LLM Agents for Dissecting Malicious PyPI Packages

Modern software package registries like PyPI have become critical infrastructure for software development, but are increasingly exploited by threat actors distributing malicious packages with sophisticated multi-stage attack chains. While Large Language Models LLMs offer promising capabilities fo...

PT-2026-2039

Name of the Vulnerable Software and Affected Versions jjjfood and jjjshop food versions up to 20260103 Description A flaw exists in jjjfood and jjjshop food that allows for SQL injection. The issue is located in unknown code within the file '/index.php/api/product.category/index'. Manipulation of...

EUVD-2026-1862

Malicious code in oncecall PyPI...

XXE

Install dependencies npm init -y npm install e...

CVE-2023-45471

The QAD Search Server is vulnerable to Stored Cross-Site Scripting XSS in versions up to, and including, 1.0.0.315 due to insufficient checks on indexes. This makes it possible for unauthenticated attackers to create a new index and inject a malicious web script into its name, that will execute...

CVE-2023-4110

A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument sessionid leads to cross site scripting. The attack can be launched...

CVE-2023-4173

A vulnerability, which was classified as problematic, was found in mooSocial mooStore 3.1.6. Affected is an unknown function of the file /search/index. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this...