Apache Parquet code-related vulnerabilities

Apache Parquet is a columnar storage format from the Apache USA Foundation. It can be used in any project in the Hadoop ecosystem. A code issue vulnerability exists in Apache Parquet 1.15.0 and earlier versions, which stems from a schema parsing in the parquet-avro module that could lead to the...

CLSA-2025-1743409093 libxml2: Fix of CVE-2024-56171

CVE-2024-56171: Fix use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c...

Important: libxml2

Issue Overview: libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML...

CLSA-2025-1742466508 libxml2: Fix of 2 CVEs

CVE-2024-56171: fix use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c - CVE-2025-24928: fix stack-based buffer overflow in xmlSnprintfElements in valid.c...

CVE-2024-7764

Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection when generate_sql calls extract_sql on the LLM response. An attacker can insert a semicolon between a data field and their own command, causing extract_sql to remove LLM-generated SQL and execute the attacker’s command ...

Malicious code in template-schema-validation-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdd56d05daf9702e64665a77117964d0b8cef461de8e1e1d9d7fe30ba085e7d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in template-schema-validation-tools

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-26853

DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema...

Azure Linux 3.0 Security Update: libxml2 (CVE-2024-56171)

The version of libxml2 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-56171 advisory. - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and...

CVE-2025-30153

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

RLSA-2025:1671 Important: mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. Security Fixes: openssl: SSLselectnextproto buffer overread CVE-2024-5535 krb5: GSS message token handling CVE-2024-37371 curl: libcurl: ASN.1 date pars...

com.squareup.wire:wire-compiler (2.0.0-beta1), com.squareup.wire:wire-gson-support (2.0.0-beta1) +2 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta1)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta1 - com.squareup.wire:wire-gson-support 2.0.0-beta1...

com.squareup.wire:wire-compiler (2.0.0-beta2), com.squareup.wire:wire-gson-support (2.0.0-beta2) +2 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta2)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta2 - com.squareup.wire:wire-gson-support 2.0.0-beta2...

com.squareup.wire:wire-compiler (2.0.0-beta3), com.squareup.wire:wire-gson-support (2.0.0-beta3) +2 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta3)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta3 - com.squareup.wire:wire-gson-support 2.0.0-beta3...

com.squareup.wire:wire-compiler (2.0.0-beta6), com.squareup.wire:wire-gson-support (2.0.0-beta6) +3 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta6)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta6 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta6 - com.squareup.wire:wire-gson-support 2.0.0-beta6...

com.squareup.wire:wire-compiler (2.0.0-beta7), com.squareup.wire:wire-gson-support (2.0.0-beta7) +3 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta7)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta7 - com.squareup.wire:wire-gson-support 2.0.0-beta7...

com.squareup.wire:wire-compiler (2.0.0-beta8), com.squareup.wire:wire-gson-support (2.0.0-beta8) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta8)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta8 - com.squareup.wire:wire-gson-support 2.0.0-beta8...

com.squareup.retrofit2:converter-wire (2.0.0-beta3), com.squareup.wire:wire-compiler (2.0.0) +6 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0)

com.squareup.wire:wire-runtime MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit2:converter-wire 2.0.0-beta3 - com.squareup.wire:wire-compiler 2.0.0 -...

com.squareup.wire:wire-compiler (2.0.1), com.squareup.wire:wire-gson-support (2.0.1) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.1)

com.squareup.wire:wire-runtime MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.1 - com.squareup.wire:wire-gson-support 2.0.1 -...

com.github.jg513:webpb-spring (0.0.4), com.squareup.wire:wire-compiler (3.2.2) +17 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (3.2.2)

com.squareup.wire:wire-runtime MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.github.jg513:webpb-spring 0.0.4 - com.squareup.wire:wire-compiler 3.2.2 -...