9517 matches found
Security update for gstreamer-plugins-base
This update for gstreamer-plugins-base fixes the following issues: CVE-2024-47538: Fixed a stack-buffer overflow in vorbishandleidentificationpacket bsc1234415. CVE-2024-47835: Fixed NULL-pointer dereference in LRC subtitle parser bsc1234450. CVE-2024-47600: Fixed Out-of-bounds read in...
CVE-2025-0454
A Server-Side Request Forgery SSRF vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the urlparse function from the urllib.parse library and the requests library. A malicious...
CVE-2024-6827
Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data...
CVE-2024-10457
CVE-2024-10457 describes multiple SSRF vulnerabilities in the significant-gravitas/autogpt project (agpt-platform-beta-v0.1.1). The issues arise when inputs to a set of GitHub integration and web-search blocks are controlled by untrusted sources, enabling requests to internal or attacker-controll...
CVE-2024-7045
...
CVE-2024-10550
CVE-2024-10550 affects h2oai/h2o-3 v3.46.0.1. The /3/ParseSetup endpoint applies a user-specified regex to a user-controlled string, enabling Regular Expression DoS (ReDoS) that can exhaust server resources and render the service unresponsive. Affected component: h2o-core in h2o-3; root cause is ...
CVE-2024-9098 Privilege Escalation in lunary-ai/lunary
In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new members with billing permissions, thereby gaining unauthorized access to billing resources. This issue arises because the user creation endpoint does not restrict admins from invitin...
CVE-2025-0188 SSRF in gaizhenbiao/chuanhuchatgpt
A Server-Side Request Forgery SSRF vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access th...
CVE-2024-13060 Improper Authorization in mintplex-labs/anything-llm
A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1...
[SECURITY] [DLA 4087-1] python3.9 security update
Debian LTS Advisory DLA-4087-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton March 20, 2025 https://wiki.debian.org/LTS Package : python3.9 Version : 3.9.2-1+deb11u3 CVE ID : CVE-2022-0391 CVE-2025-0938 CVE-2025-1795 Multiple vulnerabilities were discovered in...
CVE-2025-27718
creationtimestamp| type| source ---|---|--- 2025-03-20 06:35:55+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3lks3grzvck23 2025-03-28 08:27:25+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/9284 2025-03-28 11:53:24+00:00| seen| https://t.me/cvedetector/21386...
CVE-2024-13881
creationtimestamp| type| source ---|---|--- 2025-03-20 06:18:03+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8171 2025-03-20 09:02:17+00:00| seen| https://t.me/cvedetector/20696 2025-03-20 09:03:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lksdomb2ac2m...
CVE-2025-1314
CVE-2025-1314 (Custom Twitter Feeds – A Tweets Widget or X Feed Widget for WordPress) is a CSRF vulnerability present in all versions up to and including 2.2.5. The root cause is missing or incorrect nonce validation in the ctf_clear_cache_admin() function, enabling unauthenticated attackers to r...
CVE-2025-27779
creationtimestamp| type| source ---|---|--- 2025-03-19 23:00:33+00:00| published-proof-of-concept| https://t.me/cvedetector/20680 2025-03-20 00:49:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkri2jo34k2j...
CVE-2025-27782
creationtimestamp| type| source ---|---|--- 2025-03-19 23:00:21+00:00| seen| https://t.me/cvedetector/20672 2025-03-19 23:33:39+00:00| published-proof-of-concept| Telegram/e8K6ei2MJobaYeBw9lEyjrqpWhjWmsfq7ceAEPONUHatpcs 2025-03-20 00:49:11+00:00| seen|...
CVE-2025-29924
creationtimestamp| type| source ---|---|--- 2025-03-19 19:06:22+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114190659236671973 2025-03-19 20:00:51+00:00| published-proof-of-concept| Telegram/pKc-k4S4UpucBi-A8jZui2WxqHw-KLQAnPldAvhIPnjHqVQ 2025-03-19 20:18:15+00:00|...
CVE-2025-26475
creationtimestamp| type| source ---|---|--- 2025-03-19 18:43:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkqtnbfvtu26 2025-03-19 18:49:29+00:00| seen| https://t.me/cvedetector/20652...
CVE-2025-30153
A flaw was found in kin-openapi. This vulnerability allows excessive memory consumption via upload of a crafted ZIP file a "ZIP bomb". Mitigation Disable any endpoints in your OpenAPI schema that allows multipart/form-data or allows the uploading of a zipfile...
CVE-2025-29783
A flaw was found in vLLM. In deployments where vLLM is configured to use Mooncake to distribute KV across hosts, this vulnerability allows remote code execution via unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces. Mitigation A possible mitigation would be making...