PT-2025-22277 · Langroid · Langroid

Name of the Vulnerable Software and Affected Versions: Langroid versions prior to 0.53.15 Description: The issue concerns the use of pandas eval through the compute from docs function in the LanceDocChatAgent component. This allows an attacker to potentially run malicious commands, compromising t...

UBUNTU-CVE-2024-8374

UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 are vulnerable to code injection via the 3MF format reader /plugins/ThreeMFReader.py. The vulnerability arises from improper handling of the droptobuildplate property within 3MF files, which are ZIP archives containing the model data. When...

CVE-2023-22853

Tiki before 24.1, when featurecreatewebhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval...

SUSE-SU-2021:1621-1 Security update for python3

This update for python3 fixes the following issues: Security issues fixed: - CVE-2020-27619: where Lib/test/multibytecodecsupport calls eval on content retrieved via HTTP. bsc1178009 Other fixes: - Make sure to close the 'importfailed.map' file after the exception has been raised in order to avoi...

XSS when adding Stash Linked Repositories

Stash server title in the "Stash server" dropdown is not being escaped and if it contains a script tag that script will be eval'd. Our Stash QA test data has the server title "Welcome to alert666 Long Ståш Title with ..." which causes the "666" to alert when the "Add repository" button is clicked...