ROS-20251008-09

The Open Asset Import Library Assimp 3D model import library vulnerability is related to the manipulation of the mWidth/mHeight the mWidth/mHeight argument. Exploitation of the vulnerability could allow an attacker acting remotely, cause a denial of service The Open Asset Import Library Assimp 3D...

EUVD-2021-0413

Malware in sbrugna...

EUVD-2018-9419

Malware in sbrugna...

EUVD-2016-2136

Malware in sbrugna...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-392269)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-392269 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: fix OOB devmap writes when deleting elements Jordy reported issue against XSKMAP which also...

EUVD-2021-7380

Malicious code in bioql PyPI...

EUVD-2025-29591

Malicious code in bioql PyPI...

EUVD-2025-20052

Malicious code in bioql PyPI...

EUVD-2022-4199

Malicious code in bioql PyPI...

EUVD-2024-27675

Malicious code in bioql PyPI...

EUVD-2025-30754

Malicious code in bioql PyPI...

CVE-2025-10854

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...

CVE-2025-10854

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...

UNIX Symbolic Link (Symlink) Following

Overview txtai is an All-in-one open-source AI framework for semantic search, LLM orchestration and language model workflows Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the validate function due to improper sanitization of symbolic links within the...

CVE-2025-10854 Symlink Following in txtai leads to arbitrary file write when loading untrusted embedding indices

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...

CVE-2025-10854 Symlink Following in txtai leads to arbitrary file write when loading untrusted embedding indices

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...

CVE-2025-10854

The CVE-2025-10854 issue affects the txtai framework where loading compressed tar files as embedding indices is vulnerable: the existing path traversal protection does not account for symbolic links inside the tar, allowing an attacker to write arbitrary files on the filesystem when untrusted emb...

CVE-2025-10854 Symlink Following in txtai leads to arbitrary file write when loading untrusted embedding indices

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...

Prototype Pollution

devalue is vulnerable to prototype pollution. The vulnerability is due to devalue.parse not validating that an index is numeric, which allows an attacker to pass a crafted string with a proto property to assign prototypes to objects and properties...

PT-2025-38714

Name of the Vulnerable Software and Affected Versions txtai affected versions not specified Description The txtai framework permits loading compressed tar files as embedding indices. The validate function, designed to prevent path traversal, does not account for symbolic links within these tar...