458 matches found
aioimdb (>=1.0.0, <=1.0.4), imdbpie (>=5.0.0, <=5.6.5) +2 more potentially affected by CVE-2025-69872 via diskcache (2.9.0)
diskcache PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on diskcache and may be impacted: - aioimdb =1.0.0, =5.0.0, =0.1.4, =0.21.16, =0.21.18 Source cves: CVE-2025-69872 Source advisory: OSV:PYSEC-2026-2447...
aioimdb (>=1.0.5, <=1.1.2), opus-api (0.5.0) potentially affected by CVE-2025-69872 via diskcache (3.0.1)
diskcache PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on diskcache and may be impacted: - aioimdb =1.0.5, =1.1.2 - opus-api 0.5.0 Source cves: CVE-2025-69872 Source advisory: OSV:PYSEC-2026-2447...
bentodev (>=0.1.17, <=2018.11.2), clacks (0.1.1.dev845) +6 more potentially affected by CVE-2025-8869 via pip (9.0.1)
pip PYPI version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - bentodev =0.1.17, =2.4.0, =0.2.0, =0.1.4, =1.2.0, =1.11.0 Source cves: CVE-2025-8869 Source advisory: OSV:PYSEC-2026-1795...
clkhash (>=0.8.0rc1, <=0.10.1), nxviz (0.3.4) +3 more potentially affected by CVE-2023-50782 via cryptography (2.1.3)
cryptography PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - clkhash =0.8.0rc1, =1.3.12, =1.3.13, =1.3.17 Source cves: CVE-2023-50782 Source advisory: OSV:PYSEC-2026-1283...
aletheia (0.0.1), autoapply (>=0.2.0, <=0.3.2) +2 more potentially affected by CVE-2023-50782 via cryptography (2.1.2)
cryptography PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aletheia 0.0.1 - autoapply =0.2.0, =0.3.2 - django-x509 0.3.1 - opus-api 0.4.0 Source cves: CVE-2023-50782 Source advisory:...
atlassian-jwt-auth (3.1.0), igitt (>=0.4.1.dev20171005105713, <=0.4.1.dev20171202111001) +4 more potentially affected by CVE-2024-0727 via cryptography (2.0.3)
cryptography PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 3.1.0 - igitt =0.4.1.dev20171005105713, =0.3.2, =0.1.4, =1.4.5, =1.4.9 Source cves: CVE-2024-0727 Source advisory:...
clkhash (>=0.8.0rc1, <=0.10.1), nxviz (0.3.4) +3 more potentially affected by CVE-2024-0727 via cryptography (2.1.3)
cryptography PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - clkhash =0.8.0rc1, =1.3.12, =1.3.13, =1.3.17 Source cves: CVE-2024-0727 Source advisory: OSV:PYSEC-2026-1285...
aletheia (0.0.1), autoapply (>=0.2.0, <=0.3.2) +2 more potentially affected by CVE-2024-0727 via cryptography (2.1.2)
cryptography PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aletheia 0.0.1 - autoapply =0.2.0, =0.3.2 - django-x509 0.3.1 - opus-api 0.4.0 Source cves: CVE-2024-0727 Source advisory:...
Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival
A researcher found that using Anthropic’s Claude Opus 4.7, he could break into the website of Front Gate—used by every festival from Lollapalooza to Bonnaroo—and freely issue any ticket he chose...
Malicious Package
Overview ts-opus is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious code in ts-opus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b0105b34723dd6e1449c3353d1d4df0dcf94ae460a4dfd156566bb4ba372c7 ts-opus 0.0.8 ships an unmodified copy of MikeMcl/big.js README, copyright, and repository URL all reference big.js but injects an additional top-lev...
EUVD-2026-38404
vLLM is an inference and serving engine for large language models LLMs. Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to 14.9GB of float32 PCM at decode time. This vulnerability is fixed in 0.23.1rc0...
GHSA-6PR9-RP53-2PMC vLLM: OOM Denial of Service via Audio Decompression Bomb
Summary vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to 14.9GB of float32 PCM at decode time. Tested on vLLM v0.19.0. Details SpeechToTextProcessor rejects uploads over VLLMMAXAUDIOCLIPFILESIZEMB default 25MB based on...
PT-2026-50489
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.23.1rc0 Description The '/v1/audio/transcriptions' endpoint limits the size of compressed uploads but fails to limit the size of the decoded PCM Pulse Code Modulation output. PCM is an uncompressed digital audio format...
A Red-Team Study of Anthropic Fable 5 and Opus 4.8 Models
We evaluate the adversarial robustness of two frontier large language models LLMs developed by Anthropic, Fable 5 and Opus 4.8, against four families of automated jailbreak attack across 7 826 harmful intents spanning a ten-category harm taxonomy. Using the HackAgent red-teaming framework, hundre...
EUVD-2025-210147
A heap buffer overflow in the gfopusparsepacketheader function mediatools/avparsers.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...
EUVD-2025-210151
A stack overflow in the gfopusreadlength function mediatools/avparsers.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...
EUVD-2025-210152
A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...
