39362 matches found
PYSEC-2026-1857 PyTorch Lightning denial of service vulnerability
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...
PYSEC-2026-1411 Gradio Vulnerable to Open Redirect
An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an...
cradle-app (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-12217 via gradio (1.7.7)
gradio PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cradle-app =0.1.0, =0.1.1 Source cves: CVE-2024-12217 Source advisory: OSV:PYSEC-2026-1418...
PYSEC-2026-1289 DB-GPT vulnerable to Cross-Site Request Forgery
In version 0.6.0 of eosphoros-ai/db-gpt, the uvicorn app created by dbgptserver uses an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forger...
MobSF Partial Denial of Service (DoS)
Partial Denial of Service DoSProduct: MobSFVersion: v4.2.9CWE-ID: CWE-1287: Improper Validation of Specified Type of InputCVSS vector v.4.0: 6.9 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NCVSS vector v.3.1: 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HDescription: DoS in the Scans Results an...
animo-trainer (1.0.2), ankml (>=1.0.1, <=1.0.7) +31 more potentially affected by CVE-2024-49766 via werkzeug (2.3.7)
werkzeug PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - animo-trainer 1.0.2 - ankml =1.0.1, =0.9.5, =3.2.0, =1.0.5, =0.2.18, =1.0.0, =0.1.0, =2.0.0, =1.0.1, =1.0.4 and more Source cves: CVE-2024-49766...
cradle-app (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-48052 via gradio (1.7.7)
gradio PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cradle-app =0.1.0, =0.1.1 Source cves: CVE-2024-48052 Source advisory: OSV:PYSEC-2026-1408...
archivebox (>=0.4.6, <=0.4.21), autoneuro-pypi (1.0.0) +9 more potentially affected by CVE-2024-45231 via django (3.0.8)
django PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.4.6, =0.1.3, =1.2.0, =0.3.1, =1.0.1, =0.6.11, =0.9.1 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...
carml (19.1.0), nucypher (>=0.1.0a27, <=1.2.0b1) +3 more potentially affected by CVE-2024-41671 via twisted (19.7.0)
twisted PYPI version 19.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml 19.1.0 - nucypher =0.1.0a27, =1.1.0, =1.0.0, =0.2.0, =0.2.1 Source cves: CVE-2024-41671 Source advisory: OSV:PYSEC-2026-1992...
an-website (>=22.5.20, <=22.6.10), carml (>=22.7.0, <=22.7.1) +4 more potentially affected by CVE-2024-6345 via setuptools (62.3.2)
setuptools PYPI version 62.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - an-website =22.5.20, =22.7.0, =2.1.5a1, =0.0.0, =2.3.0rc3 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...
amusing-app (>=0.1.0, <=0.1.2), mamkit (>=0.1.0, <=1.0.1) +3 more potentially affected by CVE-2024-38519 via yt-dlp (2023.11.16)
yt-dlp PYPI version 2023.11.16 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - amusing-app =0.1.0, =0.1.0, =1.3.2, =0.0.1, =2023.11.16, =2024.1.5.post4 Source cves: CVE-2024-38519 Source advisory: OSV:PYSEC-2026-2065...
Open redirect in gradio
An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...
cradle-app (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-4940 via gradio (1.7.7)
gradio PYPI version 1.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cradle-app =0.1.0, =0.1.1 Source cves: CVE-2024-4940 Source advisory: OSV:PYSEC-2026-1414...
MAL-2026-7421 Malicious code in sitefinitywebapp (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7347 Malicious code in picnic-work-app-terms-of-use-nl (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in picnic-work-app-terms-of-use-fr (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in picnic-work-app-terms-of-use-nl (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7345 Malicious code in picnic-work-app-terms-of-use-de (npm)
--- -= Per source details. Do not edit below this line.=-...