llama-index-llms-openllm (>=0.0.1, <=0.4.0) potentially affected by CVE-2024-8982 via openllm (>=0.4.44, <=0.6.30)

openllm PYPI version =0.4.44, =0.0.1, =0.4.0 Source cves: CVE-2024-8982 Source advisory: SNYK:PYTHON-OPENLLM-9599694...

CVE-2025-0313

Rejected reason: REJECT DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-12055. Notes: All CVE users should reference CVE-2024-12055 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage...

PYSEC-2025-11

A vulnerability in the KnowledgeBaseWebReader class of the run-llama/llamaindex repository, version latest, allows an attacker to cause a Denial of Service DoS by controlling a URL variable to contain the root URL. This leads to infinite recursive calls to the getarticleurls method, exhausting...

PYSEC-2025-244

A vulnerability in the LangChainLLM class of the run-llama/llamaindex repository, version v0.12.5, allows for a Denial of Service DoS attack. The streamcomplete method executes the llm using a thread and retrieves the result via the getresponsegen method of the StreamingGeneratorCallbackHandler...

PYSEC-2025-244

A vulnerability in the LangChainLLM class of the run-llama/llamaindex repository, version v0.12.5, allows for a Denial of Service DoS attack. The streamcomplete method executes the llm using a thread and retrieves the result via the getresponsegen method of the StreamingGeneratorCallbackHandler...

CVE-2025-0313

...

CVE-2025-0313

...

CVE-2024-12911 SQL Injection in run-llama/llama_index

A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...

CVE-2024-12909

CVE-2024-12909 affects the FinanceChatLlamaPack within the run-llama/llama_index project (up to v0.12.3). The root cause is an SQL injection in the database_agent’s run_sql_query function, which can be exploited to inject arbitrary SQL and trigger remote code execution through PostgreSQL large ob...

CVE-2024-12909 SQL Injection to RCE in run-llama/llama_index

A vulnerability in the FinanceChatLlamaPack of the run-llama/llamaindex repository, versions up to v0.12.3, allows for SQL injection in the runsqlquery function of the databaseagent. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code executi...

CVE-2024-12704 Denial of Service (DoS) in run-llama/llama_index

A vulnerability in the LangChainLLM class of the run-llama/llamaindex repository, version v0.12.5, allows for a Denial of Service DoS attack. The streamcomplete method executes the llm using a thread and retrieves the result via the getresponsegen method of the StreamingGeneratorCallbackHandler...

Improper Validation Of Array Index

github.com/onosproject/onos-lib-go is vulnerable to Improper Validation of Array Index. The vulnerability is due to an index out-of-range error in the GetBitString function. An attacker can cause a denial of service by sending crafted input that specifies a zero value for numBits...

PT-2025-12158

Name of the Vulnerable Software and Affected Versions llama index versions prior to 0.5.1 llama index versions prior to 0.12.3 Description A vulnerability exists in the default jsonalyzer function of the JSONalyzeQueryEngine. This allows for SQL injection via prompt injection, potentially leading...

PT-2025-12140

Name of the Vulnerable Software and Affected Versions run-llama/llama index version v0.12.5 Description A vulnerability in the LangChainLLM class allows for a Denial of Service DoS attack. The stream complete method executes the llm using a thread and retrieves the result via the get response gen...

PT-2025-12156

Name of the Vulnerable Software and Affected Versions llama-index-packs-finchat versions up to v0.3.0 run-llama/llama index versions up to v0.12.3 Description A vulnerability exists in the FinanceChatLlamaPack component, allowing for SQL injection in the run sql query function within the database...

PT-2025-12114

Name of the Vulnerable Software and Affected Versions run-llama/llama index versions prior to v0.4.0 Description A SQL injection vulnerability exists in the duckdb retriever component. The issue stems from constructing SQL queries without utilizing prepared statements, which allows for the...

Security update for the Linux Kernel (Live Patch 15 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005568 fixes several issues. The following security issues were fixed: CVE-2024-46818: drm/amd/display: Check gpioid before used as array index bsc1231204. CVE-2024-46815: drm/amd/display: Check numvalidsets before accessing readerwmsets bsc1231196...

MongoDB 6.0.x < 6.0.17 / 7.0.x < 7.0.13 / 7.3.x < 7.3.4 incorrect enforcement of index constraints (SERVER-92382)

The version of MongoDB installed on the remote host is prior to 6.0.17, 7.0.13 and 7.3.4. It is, therefore, affected by a vulnerability as referenced in the SERVER-92382 advisory. - PrepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries...

Applio 信息泄露漏洞

Applio is an open source AI speech conversion tool from Spanish AI Hispano. An information disclosure vulnerability exists in Applio 3.2.8-bugfix and earlier versions, which stems from an arbitrary file read issue in the exportindex function of train.py, which could lead to the reading of arbitra...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the indexonUpdateStatus function in Orders.php, which does not check for the permissions of the user before modifying an order. Remediation Upgrade tastyigniter/tastyigniter to version 4.0.0-beta.1 or higher...