2320 matches found
msticpy
MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...
CVE-2024-42992
CVE-2024-42992 Python Pip Pandas v2.2.2 has been found to contain an arbitrary file Pip Pandas all versions - =2.2.2 An arbitrary file read vulnerability exists in the "pandas" library, allowing an attacker to read any file in the file system without restrictions. This vulnerability enables...
CVE-2024-3408-dtale
CVE-2024-3408 - D-Tale Authentication Bypass & RCE Reproducible lab environment for CVE-2024-3408, an authentication bypass and remote code execution vulnerability in D-Tale. Vulnerability D-Tale versions up to 3.15.1 are vulnerable due to: 1. Hardcoded SECRETKEY "Dtale" for Flask session signing...
CVE-2026-57845
A flaw was found in datasets. This vulnerability allows an attacker to achieve arbitrary code execution by convincing a victim to load a maliciously crafted dataset file. Due to insecure deserialization—the process of restoring saved data back into program objects—untrusted data loaded through th...
CVE-2026-57845
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed b...
CVE-2026-57845 Hugging Face Datasets 5.1.0 Pickle Deserialization RCE via Pandas Builder
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed b...
CVE-2026-57845
Hugging Face Datasets version 5.1.0 is vulnerable to Remote Code Execution (RCE) via insecure deserialization. The root cause lies in the deprecated pandas packaged builder , which processes user-supplied data files through pandas.read_pickle() without validation. When a victim calls datasets.loa...
CVE-2026-57845 Hugging Face Datasets 5.1.0 Pickle Deserialization RCE via Pandas Builder
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed b...
EUVD-2026-109092
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed b...
Exploit for CVE-2026-57845
CVE-2026-57845: Hugging Face datasets datasetmodulefactory...
PT-2026-122146
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed b...
dagster-snowflake (>=0.21.8, <=0.22.3), dagster-snowflake-pandas (>=0.21.8, <=0.22.3) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.4.1)
snowflake-connector-python PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.21.8, =0.21.8, =0.21.8, =0.22.3 - quacker 0.6.2 Source cves: CVE-2026-86597 Source...
CVE-2026-51898
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...
PT-2026-104362
Name of the Vulnerable Software and Affected Versions pandas-ai version 3.0.0 Description The software is subject to code injection within the CodeExecutor.execute function. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...
EUVD-2026-91705
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...
CVE-2026-51898: Improper Control of Generation of Code
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...
CVE-2026-51898
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...
CVE-2026-51898
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...
CVE-2026-51898
The sinaptik-ai pandas-ai library, version 3.0.0 , is vulnerable to a Code Injection vulnerability within the CodeExecutor.execute function. This flaw is associated with CWE-94 (Improper Control of Generation of Code). The vulnerability has a CRITICAL severity (CVSS 3.1 score of 9.8 ), allowing f...