BELL-CVE-2025-21867

Bulletin has no description...

BELL-CVE-2023-53004

Bulletin has no description...

BELL-CVE-2025-21885

Bulletin has no description...

BELL-CVE-2023-53023

Bulletin has no description...

BELL-CVE-2023-52942

Bulletin has no description...

BELL-CVE-2023-53017

Bulletin has no description...

BELL-CVE-2023-52973

Bulletin has no description...

BELL-CVE-2023-52940

Bulletin has no description...

CVE-2025-29486

libming v0.4.8 was discovered to contain a memory leak via the parseSWFPLACEOBJECT3 function...

Flask-CORS allows for inconsistent CORS matching

A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquoteplus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path...

GHSA-J3WR-M6XH-64HG LlamaIndex Improper Handling of Exceptional Conditions vulnerability

A vulnerability in the LangChainLLM class of the run-llama/llamaindex repository, version v0.12.5, allows for a Denial of Service DoS attack. The streamcomplete method executes the llm using a thread and retrieves the result via the getresponsegen method of the StreamingGeneratorCallbackHandler...

GHSA-WXPC-2674-RXVW Feast Cross-Origin Resource Sharing vulnerability

A Cross-Origin Resource Sharing CORS vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security...

CVE-2025-0313

Rejected reason: REJECT DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-12055. Notes: All CVE users should reference CVE-2024-12055 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2024-7776

A vulnerability in the downloadmodel function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability can be exploited by an attacker to overwrite files i...

CVE-2024-12776 Authentication Bypass in langgenius/dify

In langgenius/dify v0.10.1, the /forgot-password/resets endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application...

CVE-2024-8018 Denial of Service (DOS) in imartinez/privategpt

A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service DOS attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process these characters, rendering privateGPT inaccessible...

BELL-CVE-2025-27835

Bulletin has no description...

BELL-CVE-2025-27832

Bulletin has no description...

PT-2025-12096 · Unknown · Automatic1111/Stable-Diffusion-Webui

Name of the Vulnerable Software and Affected Versions: automatic1111/stable-diffusion-webui version 1.10.0 Description: An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a...

PT-2025-12154 · Unknown · Infiniflow/Ragflow

Name of the Vulnerable Software and Affected Versions: infiniflow/ragflow version RAGFlow-0.13.0 Description: A vulnerability in infiniflow/ragflow allows for partial account takeover via insecure data querying. The issue arises from the way tenant IDs are handled in the application. If a user ha...