1254 matches found
Security Bulletin: Vulnerability in Jinja2 affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2024-56326, CVE-2024-56201]
Summary The Jinja2 package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVEs CVE-2024-56326, CVE-2024-56201 Vulnerability Details CVEID:CVE-2024-56326 DESCRIPTION: Jinja is an extensible templating engine. Prior to 3.1.5, An oversig...
Remote Code Execution (RCE)
Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Remote Code Execution RCE due to insufficient isolation in the Python Code Node that uses Pyodide. An authenticated attacker with permissions to create or modify workflows can execute arbitrary...
Remote Code Execution (RCE)
Overview Affected versions of this package are vulnerable to Remote Code Execution RCE due to insufficient isolation in the Python Code Node that uses Pyodide. An authenticated attacker with permissions to create or modify workflows can execute arbitrary commands on the host system by creating or...
injection-research
injection-research A study comparing injection vulnerabilities...
The vulnerability of the eval() function on the DocsGPT software platform allows a perpetrator to execute any Python code.
The vulnerability of the eval function in the DocsGPT software platform for generative artificial intelligence involves a lack of measures taken to clean data at the management level. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary Python code...
CVE-2025-33184
NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering...
Grid-STIX: A STIX 2.1-Compliant Cyber-Physical Security Ontology for Power Grid
Modern electrical power grids represent complex cyber-physical systems requiring specialized cybersecurity frameworks beyond traditional IT security models. Existing threat intelligence standards such as STIX 2.1 and MITRE ATT&CK lack coverage for grid-specific assets, operational technology...
CVE-2025-64703
MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although the process run in sandbox. Version 2.3.1 fixes the issue...
CVE-2025-64703 MaxKB has Information Leak in sandbox
MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although the process run in sandbox. Version 2.3.1 fixes the issue...
CVE-2025-64703
MaxKB (open‑source enterprise AI assistant) contains an information disclosure vulnerability in versions prior to 2.3.1. The issue arises from Python code in the tool module, where a user can obtain sensitive information despite the process running in a sandbox. The root cause is effectively a sa...
CVE-2025-64703 MaxKB has Information Leak in sandbox
MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although the process run in sandbox. Version 2.3.1 fixes the issue...
CVE-2025-64511 MaxKB has SSRF in sandbox
MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can access internal network services such as databases through Python code in the tool module, although the process runs in a sandbox. Version 2.3.1 fixes the issue...
CVE-2025-64511: Server-Side Request Forgery (SSRF)
MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can access internal network services such as databases through Python code in the tool module, although the process runs in a sandbox. Version 2.3.1 fixes the issue...
CVE-2025-64703: Exposure of Sensitive Information to an Unauthorized Actor
MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although the process run in sandbox. Version 2.3.1 fixes the issue...
Taught by the Flawed: How Dataset Insecurity Breeds Vulnerable AI Code
AI programming assistants have demonstrated a tendency to generate code containing basic security vulnerabilities. While developers are ultimately responsible for validating and reviewing such outputs, improving the inherent quality of these generated code snippets remains essential. A key...
Eval Injection
Overview talkpipe is a Python internal and external DSL for writing generative AI analytics Affected versions of this package are vulnerable to Eval Injection due to using the function eval unsafe in the compileLambda function in the talkpipe/util/datamanipulation.py file. An attacker can execute...
YouTube-Scraper-POC
What this repo is The code in this repository is a proof of...
MAL-2025-191843 Malicious code in python3-6 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d48e27507362baa15b8e41d1554bce82077fcc870112ab6cb4d17694b47c8ef3 During installation, the obfuscated code is run and connect with a remote server. In the current version, the code just opens a URL without exfiltrating any...
