CVE-2026-75760 AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

CVE-2026-75760 AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

Malicious code in @mastra/vectorize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3388ddbcdb1a37e8cb864a2b4b8b7b6a1c7b3dcd00735a6f962f56432a9b0ab The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6042 Malicious code in @mastra/vectorize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3388ddbcdb1a37e8cb864a2b4b8b7b6a1c7b3dcd00735a6f962f56432a9b0ab The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in vectorize-perf-alt (npm)

The package vectorize-perf-alt was found to contain malicious code...

MAL-2025-48768 Malicious code in vectorize-perf-alt (npm)

The package vectorize-perf-alt was found to contain malicious code...

EUVD-2024-2983

Malicious code in bioql PyPI...

CVE-2024-6971

A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the lollmsfilesystem.py file. The functions addragdatabase, togglemountragdatabase, and vectorizefolder do not implement security measures such as sanitizepathfromendpoint or sanitizepath. This allows a...

Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py

A path traversal vulnerability exists in the ParisNeo/lollms repository, specifically in the lollmsfilesystem.py file. The functions addragdatabase, togglemountragdatabase, and vectorizefolder do not implement security measures such as sanitizepathfromendpoint or sanitizepath. This allows an...

Directory Traversal

Overview lollms is a python library for AI personality definition Affected versions of this package are vulnerable to Directory Traversal through the lollmsfilesystem.py file. An attacker can manipulate file paths to access or modify files outside of the intended directories by supplying maliciou...

GHSA-7PGR-32FX-C6X9 Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py

A path traversal vulnerability exists in the ParisNeo/lollms repository, specifically in the lollmsfilesystem.py file. The functions addragdatabase, togglemountragdatabase, and vectorizefolder do not implement security measures such as sanitizepathfromendpoint or sanitizepath. This allows an...

CVE-2024-6971

A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the lollmsfilesystem.py file. The functions addragdatabase, togglemountragdatabase, and vectorizefolder do not implement security measures such as sanitizepathfromendpoint or sanitizepath. This allows a...

CVE-2024-6971

CVE-2024-6971 describes a path traversal in the ParisNeo/lollms-webui project where functions in lollms_file_system.py (add_rag_database, toggle_mount_rag_database, vectorize_folder) do not sanitize paths, allowing an attacker to vectorize arbitrary .sqlite files on a victim’s machine. This can e...