Division by zero

Overview nvidia-pytriton is a PyTriton - Flask/FastAPI-like interface to simplify Triton's deployment in Python environments. Affected versions of this package are vulnerable to Division by zero due to division by zero when TRITONSERVERDataTypeByteSizedatatype returns zero for BYTES data type. An...

Use of Weak Hash

Overview Affected versions of this package are vulnerable to Use of Weak Hash like the Md5 hash. An attacker can bypass file integrity verification by generating files with colliding MD5 hashes and distributing malicious content that passes integrity checks. Remediation Upgrade...

Use of Weak Hash

Overview Affected versions of this package are vulnerable to Use of Weak Hash like the Md5 hash. An attacker can bypass file integrity verification by generating files with colliding MD5 hashes and distributing malicious content that passes integrity checks. Remediation Upgrade...

Use of Weak Hash

Overview Affected versions of this package are vulnerable to Use of Weak Hash like the Md5 hash. An attacker can bypass file integrity verification by generating files with colliding MD5 hashes and distributing malicious content that passes integrity checks. Remediation Upgrade...

Use of Weak Hash

Overview Affected versions of this package are vulnerable to Use of Weak Hash like the Md5 hash. An attacker can bypass file integrity verification by generating files with colliding MD5 hashes and distributing malicious content that passes integrity checks. Remediation Upgrade...

Server-side Request Forgery (SSRF)

Overview ip is a Node library. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ip.isPublic and ip.isPrivate functions. An attacker can interact with internal network resources by supplying specially crafted IP address such as octal localhost format...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ip.isPublic and ip.isPrivate functions. An attacker can interact with internal network resources by supplying specially crafted IP address such as octal localhost format "017700000001" that is...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the filterKeyword function of the Blacklist Handler process in /com/ruoyi/generator/controller. An attacker can access or modify sensitive data, or disrupt application functionality by injecting malicious SQL statements...

Arbitrary Command Injection

Overview mcp-kubernetes-server is a The mcp-kubernetes-server is a Model Context Protocol MCP server that enables AI assistants to interact with Kubernetes clusters. It serves as a bridge between AI tools like Claude, Cursor, and GitHub Copilot and Kubernetes, translating natural language request...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the SelectListPage function in modules/system/dao/SysRoleDao.go. An attacker can access or modify sensitive data, or disrupt application functionality by injecting malicious SQL code through the sortName argument...

Race Condition

Overview @nguniversal/common is an Angular Universal module that is common across server-side rendering app irrespective of the rendering engine Affected versions of this package are vulnerable to Race Condition between multiple concurrent requests in the global platform injector, when using the...

Improper Input Validation

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Improper Input Validation in the authentication process. An attacker can gain unauthorized access to user sessions by submitting crafted input,...

Improper Input Validation

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Input Validation in the authentication process. An attacker can gain unauthorized access to user sessions by submitting crafted input, potentially leading to sessi...

CVE-2025-58755 MONAI has path traversal issue that may lead to arbitrary file writes

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. The extractall function zipfile.extractalloutputdir is used directly to process compressed files. It is used in many places in the project. In versions up to and including 1.5.0, when the Zip file containing malicious...

Buffer Over-read

Overview Affected versions of this package are vulnerable to Buffer Over-read via the DiaSymReader.dll process. An attacker can execute arbitrary code by exploiting a buffer over-read condition when the application processes specially crafted input. This issue affects EOL ASP.NET 6.0.0 = 6.0.36 a...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper handling of integer values in the msdia140.dll process. An attacker can execute arbitrary code by supplying specially crafted input that triggers an integer overflow and subsequent heap-bas...

Use After Free

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Use After Free that could allow remote code...

Use After Free

Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Use After Free that could allow remote code execution...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /status endpoint, which returns detailed version and build information. An attacker can gain insights into the software version and configuration by sending unauthenticated requests to this endpoint and...

Permissive Regular Expression

Overview @mathharo/promptcraft-sanitize is a Sanitizer fix for overlapping multi-token patterns. Affected versions of this package are vulnerable to Permissive Regular Expression due to insufficient replacement of multi-character tokens. An attacker can execute arbitrary scripts in the context of...