28019 matches found
EUVD-2026-42059
Improper validation leads to a generic XSS vector in the language override feature...
GO-2026-5919 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder
Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder...
GO-2026-5925 Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder
Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder...
PYSEC-2026-1759 Parsl Monitoring Visualization Vulnerable to SQL Injection
Affected Product: Parsl Python Parallel Scripting Library Component: parsl.monitoring.visualization Vulnerability Type: SQL Injection CWE-89 Severity: High CVSS Rating Recommended: 7.5 - 8.6 URL: https://github.com/Parsl/parsl/blob/master/parsl/monitoring/visualization/views.py Summary A SQL...
PYSEC-2026-1556 llama-index has Insecure Temporary File
The llamaindex library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, dat...
PYSEC-2026-1981 Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's removelanguagecode method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from...
PYSEC-2026-2029 Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Impact concat may skip evaluation of side effects when the length of an argument is zero. this is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero:...
PYSEC-2026-1624 Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks
From @jackfromeast and @superboy-zjc: We have identified a class pollution vulnerability in Mesop = 0.14.0 application that allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime. This vulnerability could directly lead to a denial of service Do...
GO-2026-5894 Casdoor does not validate the AudienceRestriction element in SAML assertions in github.com/casdoor/casdoor
Casdoor does not validate the AudienceRestriction element in SAML assertions in github.com/casdoor/casdoor...
GO-2026-5837 DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph
The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language DQL injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to brea...
Frappe has possibility of SQL injection due to improper validations
ImpactAn SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. WorkaroundsUpgrading is required, no other workaround is present. CreditsThanks to Thanh of Calif.io for reporting the issue...
PYSEC-2026-1391 Frappe has possibility of SQL injection due to improper validations
Impact SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. Workarounds Upgrading is required, no other workaround is present...
LlamaIndex Improper Handling of Exceptional Conditions vulnerability
A vulnerability in the LangChainLLM class of the run-llama/llamaindex repository, version v0.12.5, allows for a Denial of Service DoS attack. The streamcomplete method executes the llm using a thread and retrieves the result via the getresponsegen method of the StreamingGeneratorCallbackHandler...
PYSEC-2026-1934 Spacy-LLM Server-Side Template Injection (SSTI) vulnerability
A Server-Side Template Injection SSTI vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a crafted payload into the template field...
PYSEC-2026-1151 Apache Airflow MySQL Provider is Vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dumpsql or loadsql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not...
PYSEC-2026-1855 python-sql SQL injection vulnerability
A vulnerability was found in python-sql where unary operators do not escape non-Expression like And and Or which makes any system exposing those vulnerable to an SQL injection attack...
PYSEC-2026-1993 unstructured XML External Entity (XXE)
unstructured v.0.14.2 and before is vulnerable to XML External Entity XXE via the XMLParser...
PYSEC-2026-2024 vLLM denial of service vulnerability
A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service...
PYSEC-2026-1431 Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference
RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity...
