External Control of File Name or Path

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to External Control of File Name or Path through the /read-examples endpoint. An attacker can read any local JSON file, containing API keys by sending a crafted POST...

Server-side Request Forgery (SSRF)

Overview fschat is an An open platform for training, serving, and evaluating large language model based chatbots. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to improper web server configuration. An attacker can access internal server resources and dat...

Origin Validation Error

Overview feast is a Python SDK for Feast Affected versions of this package are vulnerable to Origin Validation Error due to improper CORS configuration on the server. An attacker can bypass security controls and potentially access sensitive information by sending requests from unauthorized origin...

Path Equivalence

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Path Equivalence due to the blockedpath function only blocking standard pathnames. On Windows systems, an attacker can read unauthorized files by usi...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the runtool command which exposes classes in the water.tools package via the ast parser. An attacker can shut down the server and write large files to arbitrary directories by exploiting the...

CVE-2024-32962

creationtimestamp| type| source ---|---|--- 2025-03-20 12:00:09+00:00| published-proof-of-concept| Telegram/p7hLiccLONdwM2MX7hUwrX2iUDsZPVrkGyNQ09EnNeNIo2E...

Cross-site Request Forgery (CSRF)

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to overly permissive CORS settings that allow cross-origin requests from all origins. An attacker can manipulate the state of the...

CVE-2024-12048

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:42+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8199...

CVE-2024-12779

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:42+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8198...

CVE-2024-10650

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:41+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8197...

CVE-2024-12866

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:34+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8193...

CVE-2024-8248

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:33+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8192...

CVE-2024-10549

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:33+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8191...

CVE-2024-12063

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:32+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8190...

CVE-2024-12392

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:26+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8186...

CVE-2024-6825

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:26+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8187...

CVE-2024-10457

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:24+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8185...

CVE-2024-12215

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:18+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8181...

CVE-2024-10956

creationtimestamp| type| source ---|---|--- 2025-03-20 10:19:17+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8180...

CVE-2025-0183

A stored cross-site scripting XSS vulnerability exists in the Latex Proof-Reading Module of binary-husky/gptacademic version 3.9.0. This vulnerability allows an attacker to inject malicious scripts into the debuglog.html file generated by the module. When an admin visits this debug report, the...