1396 matches found
EUVD-2026-42100
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing...
CVE-2026-50530
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing...
CVE-2026-50530
DataEase prior to version 2.10.24 exposes a vulnerability in the share mode chart data interface. The API path POST /de2api/chartData/getData only validates that sceneId matches the resourceId in the link token and does not verify whether tableId and field IDs in the request body belong to the sh...
dataset-image-annotator (0.0.19), fastapi-auth-service (>=0.0.3, <=0.0.7) potentially affected by CVE-2025-68481 via fastapi-users (10.2.1)
fastapi-users PYPI version 10.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - dataset-image-annotator 0.0.19 - fastapi-auth-service =0.0.3, =0.0.7 Source cves: CVE-2025-68481 Source advisory: OSV:PYSEC-2026-1363...
deepmtp (>=0.0.5, <=0.0.12), tid-costa-rica-poverty-prediction (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2025-30167 via jupyter-core (4.10.0)
jupyter-core PYPI version 4.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - deepmtp =0.0.5, =0.0.1, =0.12.0, =0.12.1 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...
PYSEC-2026-1308 docarray prototype pollution
A vulnerability was found in docarray up to 0.40.1. It has been rated as critical. Affected by this issue is the function getitem of the file /docarray/data/torchdataset.py of the component Web API. The manipulation leads to improperly controlled modification of object prototype attributes...
dataset-format-benchmark (0.0.10) potentially affected by CVE-2024-8020 via pytorch-lightning (1.9.2)
pytorch-lightning PYPI version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dataset-format-benchmark 0.0.10 Source cves: CVE-2024-8020 Source advisory: OSV:PYSEC-2026-1857...
olorenchemengine (>=0.0.0, <=1.0.3), recsys-slates-dataset (>=0.0.5, <=0.0.6) potentially affected by CVE-2024-8020 via pytorch-lightning (1.4.1)
pytorch-lightning PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - olorenchemengine =0.0.0, =0.0.5, =0.0.6 Source cves: CVE-2024-8020 Source advisory: OSV:PYSEC-2026-1857...
GluonCV Arbitrary File Write via TarSlip
A vulnerability in the ImageClassificationDataset.fromcsv API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can...
PYSEC-2026-1406 GluonCV Arbitrary File Write via TarSlip
A vulnerability in the ImageClassificationDataset.fromcsv API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can...
codeformer-perceptor (>=0.1.0, <=0.1.2), controlnet-hinter (>=0.0.3, <=0.0.5) +17 more potentially affected by CVE-2024-27763 via basicsr (>=1.3.4.9, <=1.4.2)
basicsr PYPI version =1.3.4.9, =0.1.0, =0.0.3, =1.0.2, =0.1.0, =2.2.4.5, =0.3.3, =0.0.1, =0.1.0, =0.2.2.3, =0.1.1, =0.1.6 and more Source cves: CVE-2024-27763 Source advisory: OSV:PYSEC-2026-1215...
PYSEC-2026-1628 MindsDB Cross-site Scripting vulnerability
A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...
Apache Superset: Improper data authorization when creating a new dataset
Apache Superset with custom roles that include can write on dataset and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data.This issue affects Apach...
PYSEC-2026-1191 Apache Superset: Improper data authorization when creating a new dataset
Apache Superset with custom roles that include can write on dataset and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data. This issue affects Apac...
Out of memory error when submitting the dataset form with a specially-crafted field
ImpactWhen submitting a POST request to the /dataset/new endpoint including either the auth cookie or the Authorization header with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server.To trigger this error the user needs to have permissions to create or...
PYSEC-2026-1249 Out of memory error when submitting the dataset form with a specially-crafted field
Impact When submitting a POST request to the /dataset/new endpoint including either the auth cookie or the Authorization header with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error the user needs to have permissions to create o...
Apache Superset Open Redirect vulnerability
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0...
Apache Superset Server-Side Request Forgery vulnerability
A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability existsin...
PYSEC-2026-1179 Apache Superset Server-Side Request Forgery vulnerability
A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in...
