62811 matches found
CVE-2026-45829
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...
CVE-2026-45829
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...
CVE-2026-45829
CVE-2026-45829 affects the ChromaDB Python project (version 1.0.0 and later). It is a pre-authentication code-injection vulnerability that allows an unauthenticated attacker to execute arbitrary code on the server by supplying a malicious model repository and setting trust_remote_code to true via...
EUVD-2026-30779
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...
01os (>=0.0.5, <=0.0.13), 1claw-crewai-tools (>=0.1.0, <=0.3.2) +2088 more potentially affected by CVE-2026-45829 via chromadb (>=0.3.4, <=1.5.9)
chromadb PYPI version =0.3.4, =0.0.5, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.2.0, =0.6.4, =0.1.1, =0.0.4.dev0, =0.0.4 - adaline-crewai 0.1.0 and more Source cves: CVE-2026-45829 Source advisory: SNYK:PYTHON-CHROMADB-16758047...
CVE-2026-45395
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the tool update endpoint POST /api/v1/tools/id/id/update is missing the workspace.tools permission check that is present on the tool create endpoint. This allows a user who has been...
CLEANSTART-2026-SV37938 Security fixes for CVE-2020-26137 applied in versions: 1.25.9-r0, 1.26.17-r0, 1.26.18-r0, 1.26.4-r0
Security vulnerability affects the py3-urllib3 package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-SY44974 Security fixes for CVE-2015-20107, CVE-2015-2104, CVE-2019-16056, CVE-2019-16935, CVE-2019-20907, CVE-2019-5010, CVE-2020-14422, CVE-2020-8492, CVE-2021-23336, CVE-2021-29921, CVE-2021-3177, CVE-2022-45061, CVE-2023-27043, CVE-2024-6232, CVE-2024-6923, CVE-2025-59375, CVE-2026-3219, CVE-2026-6357 applied in versions: 3.10.5-r0, 3.11.1-r0, 3.11.5-r0, 3.12.12-r0, 3.12.13-r0, 3.12.3-r2, 3.12.6-r0, 3.6.8-r1, 3.7.5-r0, 3.8.2-r0, 3.8.4-r0, 3.8.5-r0, 3.8.7-r2, 3.8.8-r0, 3.9.4-r0, 3.9.5-r0
Multiple security vulnerabilities affect the python3 package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-EQ71754 Security fixes for CVE-2024-6345, CVE-2025-47273, CVE-2025-59375 applied in versions: 3.11.14-r0
Multiple security vulnerabilities affect the python3 package. These issues are resolved in later releases. See references for individual vulnerability details...
GHSA-36M8-W8QF-G76P SGLang: Unauthenticated RCE via --enable-custom-logit-processor
SGLang's multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads will be deserialized without validation...
Security update for cloud-init
This update for cloud-init fixes the following issues: Update to version 25.1.3 bsc1245403, CVE-2024-11584, CVE-2024-6174 Update to version 25.1.1 bsc1239715, jscPED-8680, bsc1228414, bsc1237764 Make sure a directory exists, if not create it, before writing in that location bsc1236720 rsyslog...
SUSE-SU-2026:1980-1 Security update for cloud-init
This update for cloud-init fixes the following issues: - Update to version 25.1.3 bsc1245403, CVE-2024-11584, CVE-2024-6174 - Update to version 25.1.1 bsc1239715, jscPED-8680, bsc1228414, bsc1237764 - Make sure a directory exists, if not create it, before writing in that location bsc1236720 -...
CVE-2021-47952
A flaw was found in python-jsonpickle. A remote attacker can exploit this vulnerability by crafting and sending malicious JSON payloads. When these payloads, which contain specially crafted py/repr objects, are deserialized, they can trigger the execution of arbitrary Python commands and system...
search-cve
Intelligence Engine A lean Python CLI that aggregates CVE i...
OPENSUSE-SU-2026:20777-1 Security update for python-GitPython
This update for python-GitPython fixes the following issues - CVE-2026-42215: command injection via Git options bypass bsc1264604. - CVE-2026-42284: unsafe option check validates multioptions before shlex.split transforms it bsc1264605. - CVE-2026-44243: path traversal in GitPython reference APIs...
SUSE-SU-2026:21731-1 Security update for python-lxml
This update for python-lxml fixes the following issue - CVE-2026-41066: Information disclosure via untrusted XML input leading to local file read bsc1263254...
Security update for python-python-multipart
This update for python-python-multipart fixes the following issue CVE-2026-42561: denial of service vulnerability in multipart part header parsing bsc1265250. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
SUSE-SU-2026:1961-1 Security update for python-python-multipart
This update for python-python-multipart fixes the following issue - CVE-2026-42561: denial of service vulnerability in multipart part header parsing bsc1265250...
SUSE-SU-2026:1947-1 Security update for python310
This update for python310 fixes the following issues Security issues: - CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF bsc1261969. - CVE-2026-3446: base64 decoding stops at first padded quad by default bsc1261970. - CVE-2026-4786: incomplete mitigation of , %action...