EUVD-2019-11846

Malware in sbrugna...

EUVD-2022-37783

Malicious code in bioql PyPI...

EUVD-2025-6527

Malicious code in bioql PyPI...

EUVD-2023-0886

Malicious code in bioql PyPI...

EUVD-2022-5037

Malicious code in bioql PyPI...

EUVD-2022-6209

Malicious code in bioql PyPI...

From Trace to Line: LLM Agent for Real-World OSS Vulnerability Localization

Large language models show promise for vulnerability discovery, yet prevailing methods inspect code in isolation, struggle with long contexts, and focus on coarse function- or file-level detections - offering limited actionable guidance to engineers who need precise line-level localization and...

Cross-site Scripting (XSS)

Overview llama-stack is a Llama Stack Affected versions of this package are vulnerable to Cross-site Scripting XSS via the resolveastbytype function. An attacker can modify application behavior or execute unauthorized actions by supplying unverified parameters. Details Cross-site scripting or XSS...

Llama Stack could potentially allow for remote code execution

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

CVE-2025-55178

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

CVE-2025-55178

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

CVE-2025-55178

Summary: Llama Stack versions prior to 0.2.20 are reported to be vulnerable to remote code execution due to unverified parameters accepted by the resolve_ast_by_type function. This root cause is consistently described across multiple sources (CVE-2025-55178 entries and related advisories). Affect...

Llama Stack 安全漏洞

Llama Stack is a model component of the Llama Stack API open-sourced by Meta Llama. A security vulnerability exists in Llama Stack versions prior to v0.2.20, which stems from the resolveastbytype function accepting unvalidated parameters, which could lead to remote code execution...

Linux Distros Unpatched Vulnerability : CVE-2017-11342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is an illegal address access in ast.cpp of LibSass 3.4.5. A crafted input will lead to a remote denial of service attack. CVE-2017-11342 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2019-19274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - typedast 1.3.0 and 1.3.1 has a handlekeywordonlyargs out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source but n...

usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()

...

Security Bulletin: The Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree (AST) node for each part of the expression, affects watsonx.data

Summary In scenarios where input size isn't limited, a malicious or inadvertent extremely large expression can consume excessive memory as the parser builds a huge AST. This can ultimately lead toexcessive memory usage and an Out-Of-Memory OOM crash of the process. This issue is relatively uncomm...

UBUNTU-CVE-2025-37881

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed: Add NULL pointer check in astvhubinitdev The variable d-name, returned by devmkasprintf, could be NULL. A pointer check is added to prevent potential NULL pointer dereference. This is similar to the fix in...

Denial of Service (DoS)

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Denial of Service DoS through the use of ast.literaleval to parse user input. Details Denial of Service DoS describes a family of attacks, all aimed at making a system...

LiteLLM 资源管理错误漏洞

LiteLLM is a Berri AI open source application. All LLM APIs can be called using the OpenAI format. LiteLLM has a resource management error vulnerability that stems from an insecure parsing of user input in ast.literaleval, which can be exploited by an attacker to cause a denial of service...