CVE-2024-8029 Stored XSS in imartinez/privategpt

An XSS vulnerability was discovered in the upload files process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks...

CVE-2024-10361 Arbitrary File Deletion via Path Traversal in danny-avila/librechat

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit thi...

PT-2025-12032 · Unknown · Transformeroptimus/Superagi

Name of the Vulnerable Software and Affected Versions: transformeroptimus/superagi affected versions not specified Description: An information disclosure issue exists, allowing an attacker to leak sensitive user information, including names, emails, and passwords. This can be achieved by attempti...

CVE-2024-7044: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting XSS vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. Th...

CVE-2024-8029: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability was discovered in the upload files process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks...

CVE-2025-26816

A vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic potentially allows users with particular permissions under certain conditions to see potentially sensitive data from a different user context...

CVE-2025-2202

Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sensitive information about other users such as id, name, login and email...

MAL-2025-2601 Malicious code in bsb-family-pack2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: oracle-using-macaron 3c8e5ce70508c90e2093517061f924980b3f870682878633d12afdf9903b6ecf This package is designed to exfiltrate sensitive user data, including SMS messages, contacts, call logs, and files, to a remote server via...

MSC-2025-3407

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2025-3304

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Exfiltrating sensitive private user information –...

MSC-2025-3220

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Suspect publisher – this publisher has a history ...

Autodesk AutoCAD MODEL File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk AutoCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

CVE-2024-54565

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data...

CVE-2024-54559

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data...

CVE-2024-54565

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data...

CVE-2024-54559

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data...

CVE-2024-54559

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data...

CVE-2024-54559

Apple macOS Sequoia is affected by an improper access control vulnerability within the Sandbox component . This deficiency allows an attacker to gain unauthorized access to protected information and potentially cause an application to access sensitive user data . The issue has been addressed with...

CVE-2024-54565

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data...

CVE-2024-54565

A security vulnerability in macOS stems from a deficiency in access control checks. This flaw could allow an application to gain unauthorized access to sensitive user data . The issue has been addressed with improved checks and is officially fixed in macOS Sequoia 15.2 . No specific exploit infor...