1124 matches found
📄 WordPress Quotes llama 3.1.4 Unauthenticated Blind SQL Injection
WordPress Quotes llama plugin version 3.1.4 contains an unauthenticated time-based blind SQL injection vulnerability through selectsearch. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...
CVE-2026-12512
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes...
CVE-2026-12512
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes...
CVE-2026-12512 Quotes Llama < 3.1.6 - Unauthenticated SQL Injection via sc Parameter
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes...
CVE-2026-12512 Quotes Llama < 3.1.6 - Unauthenticated SQL Injection via sc Parameter
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes...
CVE-2026-12512
The Quotes llama WordPress plugin, in versions prior to 3.1.6 , is vulnerable to an unauthenticated SQL injection . The root cause is the improper sanitization and escaping of a user-supplied parameter (specifically the sc parameter ) before it is used in a SQL query. This flaw allows attackers t...
CVE-2026-12512: Improper Neutralization of Special Elements used in an SQL Command
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes...
llama-index-readers-docling (0.1.0), quackling (>=0.0.1, <=0.4.1) potentially affected by CVE-2026-31248 via docling (1.20.0)
docling PYPI version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on docling and may be impacted: - llama-index-readers-docling 0.1.0 - quackling =0.0.1, =0.4.1 Source cves: CVE-2026-31248 Source advisory: OSV:PYSEC-2026-2454...
llama-index-readers-docling (0.1.0), quackling (>=0.0.1, <=0.4.1) potentially affected by CVE-2026-31247 via docling (1.20.0)
docling PYPI version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on docling and may be impacted: - llama-index-readers-docling 0.1.0 - quackling =0.0.1, =0.4.1 Source cves: CVE-2026-31247 Source advisory: OSV:PYSEC-2026-2455...
agent-framework-mem0 (>=1.0.0b260319, <=1.0.0b260609), engramd (>=0.1.0, <=0.1.1) +5 more potentially affected by CVE-2026-7597 via mem0ai (1.0.11)
mem0ai PYPI version 1.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - agent-framework-mem0 =1.0.0b260319, =0.1.0, =0.3.0, =0.1.0b0, =0.2.0, =1.0.0.6, =1.0.6.10 Source cves: CVE-2026-7597 Source advisory:...
cratedb-mcp (0.0.3), figma-to-compose-mcp (>=0.1.0, <=1.1.1) +7 more potentially affected by CVE-2025-64340 via fastmcp (2.6.1)
fastmcp PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - cratedb-mcp 0.0.3 - figma-to-compose-mcp =0.1.0, =0.1.0, =0.1.0, =0.0.2, =1.0.0, =3.0.0, =3.0.2 Source cves: CVE-2025-64340 Source advisory:...
llama-index-packs-vanna (>=0.1.5, <=0.3.0), nvidia-nat-vanna (>=1.4.0a20260123, <=1.7.0a20260513) +1 more potentially affected by CVE-2026-4229 via vanna (2.0.2)
vanna PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on vanna and may be impacted: - llama-index-packs-vanna =0.1.5, =1.4.0a20260123, =1.0.0, =2.0.0 Source cves: CVE-2026-4229 Source advisory: OSV:PYSEC-2026-3397...
llama-index-packs-vanna (>=0.0.1, <=0.1.4) potentially affected by CVE-2026-4229 via vanna (0.0.36)
vanna PYPI version 0.0.36 is affected by a known vulnerability. The following packages have a transitive dependency on vanna and may be impacted: - llama-index-packs-vanna =0.0.1, =0.1.4 Source cves: CVE-2026-4229 Source advisory: OSV:PYSEC-2026-3397...
agentbuddy (0.1.1.dev33), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +88 more potentially affected by CVE-2025-6211 via llama-index (>=0.4.17, <=0.12.38)
llama-index PYPI version =0.4.17, =1.1.0a20250429, =3.0.0, =1.0.5, =1.0.2, =0.0.1, =0.0.33, =0.18.2, =0.3.2, =0.1.1, =0.3.8.0, =1.2.3, =0.1.0, =0.0.8, =0.0.9 and more Source cves: CVE-2025-6211 Source advisory: OSV:PYSEC-2026-2606...
PYSEC-2026-2606 LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class
A vulnerability in the DocugamiReader class of the run-llama/llamaindex repository, up to but excluding version 0.12.41, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting ...
MAL-2026-10163 Malicious code in llama-tokenizer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b22305b1026f27be6d5b78dc19f7db7a05cc9d1818b7ebc7cda0fce92431aa02 This package typosquats llama-tokenizer-js. On require, index.js reconstructs a host and URL path from String.fromCharCode numeric arrays, downloads ...
Malicious code in llama-tokenizer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b22305b1026f27be6d5b78dc19f7db7a05cc9d1818b7ebc7cda0fce92431aa02 This package typosquats llama-tokenizer-js. On require, index.js reconstructs a host and URL path from String.fromCharCode numeric arrays, downloads ...
aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +671 more potentially affected by CVE-2025-6208 via llama-index-core (>=0.9.56, <=0.12.39)
llama-index-core PYPI version =0.9.56, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0, =0.0.3, =1.0.0rc1, =0.2.1.dev0, =0.2.1.dev0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.5 and more Source cves: CVE-2025-6208 Source advisory: OSV:PYSEC-2026-1560...
llama-index-core vulnerable to Uncontrolled Resource Consumption
The SimpleDirectoryReader component in llamaindex.core version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit numfileslimit is applied after all files in a directory are loaded into memory. Thi...