148 matches found
Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite
A vulnerability in the backuprun function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the runhash and repo.path parameters, which can be manipulated to create an...
Aim Uncontrolled Resource Consumption vulnerability
In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large...
PYSEC-2026-1089 Aim Uncontrolled Resource Consumption vulnerability
In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large...
PYSEC-2026-1080 Aim Uncontrolled Resource Consumption vulnerability
A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service DoS attack. The issue arises when a large number of tracked metrics are retrieved simultaneously from the Aim web API, causing the web server to become unresponsive. The root cause is the lack of a limit on the number o...
PYSEC-2026-1081 Aim denial of service vulnerability
A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections...
Aim External Control of File Name or Path vulnerability
A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the tarfile.extractall function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control repo.path and runhash to bypass directory existence checks and...
CVE-2024-2195
A critical Remote Code Execution RCE vulnerability was identified in the aimhubio/aim project, specifically within the /api/runs/search/run/ endpoint, affecting versions = 3.0.0. The vulnerability resides in the runsearchapi function of the aim/web/api/runs/views.py file, where improper restricti...
EUVD-2025-6933
Malicious code in bioql PyPI...
EUVD-2025-6822
Malicious code in bioql PyPI...
EUVD-2025-22341
Malicious code in bioql PyPI...
EUVD-2025-6999
Malicious code in bioql PyPI...
EUVD-2025-6963
Malicious code in bioql PyPI...
EUVD-2025-6926
Malicious code in bioql PyPI...
EUVD-2025-6826
Malicious code in bioql PyPI...
EUVD-2024-1259
Malicious code in bioql PyPI...
EUVD-2025-6888
Malicious code in bioql PyPI...
EUVD-2024-2234
Malicious code in bioql PyPI...
EUVD-2024-2392
Malicious code in bioql PyPI...
EUVD-2024-2844
Malicious code in bioql PyPI...
CVE-2025-51464
Cross-site Scripting XSS in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox...