Apache Parquet code-related vulnerabilities

Apache Parquet is a columnar storage format from the Apache USA Foundation. It can be used in any project in the Hadoop ecosystem. A code issue vulnerability exists in Apache Parquet 1.15.0 and earlier versions, which stems from a schema parsing in the parquet-avro module that could lead to the...

CLSA-2025-1743409093 libxml2: Fix of CVE-2024-56171

CVE-2024-56171: Fix use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c...

Important: libxml2

Issue Overview: libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML...

CLSA-2025-1742466508 libxml2: Fix of 2 CVEs

CVE-2024-56171: fix use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c - CVE-2025-24928: fix stack-based buffer overflow in xmlSnprintfElements in valid.c...

CVE-2024-7764

Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection when generate_sql calls extract_sql on the LLM response. An attacker can insert a semicolon between a data field and their own command, causing extract_sql to remove LLM-generated SQL and execute the attacker’s command ...

Malicious code in template-schema-validation-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdd56d05daf9702e64665a77117964d0b8cef461de8e1e1d9d7fe30ba085e7d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-26853

DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema...

Azure Linux 3.0 Security Update: libxml2 (CVE-2024-56171)

The version of libxml2 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-56171 advisory. - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and...

CVE-2025-30153

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

RLSA-2025:1671 Important: mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. Security Fixes: openssl: SSLselectnextproto buffer overread CVE-2024-5535 krb5: GSS message token handling CVE-2024-37371 curl: libcurl: ASN.1 date pars...

com.squareup.wire:wire-compiler (2.0.1), com.squareup.wire:wire-gson-support (2.0.1) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.1)

com.squareup.wire:wire-runtime MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.1 - com.squareup.wire:wire-gson-support 2.0.1 -...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.12), com.squareup.wire:wire-schema (4.0.0-alpha.12) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.0.0-alpha.12)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.12 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.12 - com.squareup.wire:wire-schema...

com.squareup.wire:wire-grpc-client (4.5.0), com.squareup.wire:wire-schema (4.5.0) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.5.0)

com.squareup.wire:wire-runtime MAVEN version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.5.0 - com.squareup.wire:wire-schema 4.5.0 Source cves:...

com.squareup.wire:wire-grpc-client (4.9.2), com.squareup.wire:wire-schema (4.9.2) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.2)

com.squareup.wire:wire-runtime MAVEN version 4.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.2 - com.squareup.wire:wire-schema 4.9.2 -...

com.squareup.wire:wire-grpc-client (4.7.1), com.squareup.wire:wire-schema (4.7.1) +1 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.7.1)

com.squareup.wire:wire-runtime MAVEN version 4.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.7.1 - com.squareup.wire:wire-schema 4.7.1 -...

androidx.benchmark:benchmark-common (>=1.3.0-alpha02, <=1.3.4), androidx.benchmark:benchmark-macro (>=1.3.0-alpha02, <=1.3.4) +8 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.7)

com.squareup.wire:wire-runtime MAVEN version 4.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - androidx.benchmark:benchmark-common =1.3.0-alpha02, =1.3.0-alpha02, =2.5.9.final, =2.5.9.final,...

com.squareup.wire:wire-grpc-client (4.9.8), com.squareup.wire:wire-schema (4.9.8) +2 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.8)

com.squareup.wire:wire-runtime MAVEN version 4.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.8 - com.squareup.wire:wire-schema 4.9.8 -...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.17), com.squareup.wire:wire-schema (4.0.0-alpha.17) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.0.0-alpha.17)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.17 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.17 - com.squareup.wire:wire-schema...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.18), com.squareup.wire:wire-schema (4.0.0-alpha.18) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.0.0-alpha.18)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.18 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.18 - com.squareup.wire:wire-schema...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.20), com.squareup.wire:wire-schema (4.0.0-alpha.20) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.0.0-alpha.20)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.20 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.20 - com.squareup.wire:wire-schema...