CVE-2024-41950 Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja...

AI/LLM Model File Contains Executable Code (Keras HFS5 .h5)

Binary data aimodelkerashfs5containsexecutablecode.nbin...

llm-toys (0.1.1), tcbench (>=0.0.20, <=0.0.22) +1 more potentially affected by CVE-2024-6578 via aim (>=3.17.4, <=3.19.3)

aim PYPI version =3.17.4, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-6578 Source advisory: GHSA-P9F2-JG9W-CX69...

AI/LLM Google Vertex AI Detection

Binary data 701478.prm...

AI/LLM Systran Detection

Binary data 701479.prm...

CVE-2024-41130 llama.cpp null pointer dereference in gguf_init_from_file

llama.cpp provides LLM inference in C/C++. Prior to b3427, llama.cpp contains a null pointer dereference in ggufinitfromfile. This vulnerability is fixed in b3427...

CVE-2024-41130

CVE-2024-41130 affects llama.cpp (C/C++) with a null pointer dereference in gguf_init_from_file. Root cause: null pointer dereference prior to version b3427. Impact: as documented, DoS-like behavior stemming from the crash/denial of service. Remediation: upgrade to version b3427 or later (per off...

CVE-2024-21552

All versions of SuperAGI are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to exploit this vulnerability and gain arbitrary code execution on the SuperAGI application server...

CVE-2024-21552

All versions of SuperAGI are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to exploit this vulnerability and gain arbitrary code execution on the SuperAGI application server...

CVE-2024-21552

All versions of SuperAGI are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to exploit this vulnerability and gain arbitrary code execution on the SuperAGI application server...

CVE-2024-21552: Improper Control of Generation of Code

All versions of SuperAGI are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to exploit this vulnerability and gain arbitrary code execution on the SuperAGI application server...

CVE-2024-6961

CVE-2024-6961 describes an XML External Entity (XXE) vulnerability in Guardrails AI when consuming RAIL documents from external sources, potentially allowing leakage of internal file data via the SYSTEM entity. The affected component is Guardrails AI and its RAIL document handling; the underlying...

eisen (0.1.9), eisen-deploy (>=0.0.1, <=0.0.2) +1 more potentially affected by CVE-2024-35198 via torchserve (>=0.0.1b20200409, <=0.7.1)

torchserve PYPI version =0.0.1b20200409, =0.0.1, =0.0.80, =0.1.0 Source cves: CVE-2024-35198 Source advisory: MEND:CVE-2024-35198...

wafl-llm (>=0.0.80, <=0.1.0) potentially affected by CVE-2024-35199 via torchserve (0.7.1)

torchserve PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on torchserve and may be impacted: - wafl-llm =0.0.80, =0.1.0 Source cves: CVE-2024-35199 Source advisory: MEND:CVE-2024-35199...

wafl-llm (>=0.0.80, <=0.1.0) potentially affected by CVE-2024-35199 via torchserve (0.7.1)

torchserve PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on torchserve and may be impacted: - wafl-llm =0.0.80, =0.1.0 Source cves: CVE-2024-35199 Source advisory: OSV:GHSA-HHPG-V63P-WP7W...

wafl-llm (>=0.0.80, <=0.1.0) potentially affected by CVE-2024-35199 via torchserve (0.7.1)

torchserve PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on torchserve and may be impacted: - wafl-llm =0.0.80, =0.1.0 Source cves: CVE-2024-35199 Source advisory: GHSA-HHPG-V63P-WP7W...

eisen (0.1.9), eisen-deploy (>=0.0.1, <=0.0.2) +1 more potentially affected by CVE-2024-35198 via torchserve (>=0.0.1b20200409, <=0.7.1)

torchserve PYPI version =0.0.1b20200409, =0.0.1, =0.0.80, =0.1.0 Source cves: CVE-2024-35198 Source advisory: OSV:GHSA-WXCX-GG9C-FWP2...

eisen (0.1.9), eisen-deploy (>=0.0.1, <=0.0.2) +1 more potentially affected by CVE-2024-35198 via torchserve (>=0.0.1b20200409, <=0.7.1)

torchserve PYPI version =0.0.1b20200409, =0.0.1, =0.0.80, =0.1.0 Source cves: CVE-2024-35198 Source advisory: GHSA-WXCX-GG9C-FWP2...

llm-toys (0.1.1), tcbench (>=0.0.20, <=0.0.22) +1 more potentially affected by CVE-2024-6227 via aim (>=3.17.4, <=3.19.3)

aim PYPI version =3.17.4, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-6227 Source advisory: OSV:GHSA-36H2-G4C8-9XCM...

llm-toys (0.1.1), tcbench (>=0.0.20, <=0.0.22) +1 more potentially affected by CVE-2024-6227 via aim (>=3.17.4, <=3.19.3)

aim PYPI version =3.17.4, =0.0.20, =0.1.0, =0.5.6 Source cves: CVE-2024-6227 Source advisory: GHSA-36H2-G4C8-9XCM...