PT-2025-50957

Name of the Vulnerable Software and Affected Versions Weaviate OSS versions prior to 1.33.4 Description An attacker who can insert data into the database can create an entry name containing an absolute path for example, /etc/... or utilize parent directory traversal ../../.. to bypass the restore...

CVE-2025-67818

Weaviate OSS before 1.33.4 is affected by CVE-2025-67818. An attacker with data-insertion access can craft an entry name with an absolute path (e.g., /etc/…) or use ../ traversal to escape the backup restore root, potentially creating or overwriting files in arbitrary locations within the app’s p...

CVE-2025-67818

An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path e.g., /etc/... or use parent directory traversal ../../.. to escape the restore root when a backup is restored, potentially creating or...

CVE-2025-67819

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...

PT-2025-50958

Name of the Vulnerable Software and Affected Versions Weaviate OSS versions prior to 1.33.4 Description A flaw exists in Weaviate OSS that allows an attacker to read arbitrary files accessible to the service process. This occurs because of insufficient validation of the fileName field during file...

CVE-2025-67819

CVE-2025-67819 affects Weaviate OSS up to version 1.33.4. The issue is caused by lack of validation of the fileName field in the transfer logic, enabling an attacker who can invoke the GetFile method while a shard is in the “Pause file activity” state and the FileReplicationService is reachable t...

CVE-2025-67819

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...

CVE-2025-67818

An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path e.g., /etc/... or use parent directory traversal ../../.. to escape the restore root when a backup is restored, potentially creating or...

CVE-2025-67819

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...

EUVD-2024-0105

Malicious code in bioql PyPI...

EUVD-2023-2241

Malicious code in bioql PyPI...

GHSA-FMJH-F678-CV3X vulnerabilities

Vulnerabilities for packages: weaviate, hydra...

CVE-2025-10954 vulnerabilities

Vulnerabilities for packages: weaviate, hydra...

CVE-2025-10954 vulnerabilities

Vulnerabilities for packages: hydra-fips, hydra, weaviate...

GHSA-FMJH-F678-CV3X vulnerabilities

Vulnerabilities for packages: hydra-fips, hydra, weaviate...

CVE-2023-38976

An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: skaffold, podman, openbao, grafana-alloy, nerdctl, flyte, opentofu, neuvector-scanner, tkn, flux-kustomize-controller, kiali, istio, dgraph, step-ca, trufflehog, kyverno-policy-reporter, boring-registry, containerd, melange, tflint, kyverno-notation-aws, kubescape,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: skaffold, podman, openbao, grafana-alloy, nerdctl, flyte, opentofu, neuvector-scanner, tkn, flux-kustomize-controller, kiali, istio, dgraph, step-ca, trufflehog, kyverno-policy-reporter, boring-registry, containerd, melange, tflint, kyverno-notation-aws, kubescape,...

GHSA-WCJW-3V6P-4V3R MindsDB Eval Injection vulnerability

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...

MindsDB Eval Injection vulnerability

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...