Lucene search
+L
PypaMost viewed

7586 matches found

PyPA
PyPA
added 2026/07/13 3:46 p.m.25 views

pypdf: Inefficient decoding of FlateDecode PNG predictor streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. PatchesThis has been fixed in pypdf==6.12.2. WorkaroundsIf you cannot upgrade yet, consider applying the changes fr...

5.1CVSS6AI score0.00166EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.25 views

Galaxy NG: command injection vulnerability

A command injection vulnerability was found in galaxyng. The dogitcheckout function in the legacy role import API v1 interpolates unsanitized git ref names branch/tag names into shell commands executed via subprocess.run with shell=True. An authenticated user who controls a git repository can...

7.5CVSS6.4AI score0.00889EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:46 p.m.25 views

malla: Stored XSS via Meshtastic node names in multiple frontend pages

Node names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping.Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor.Affected...

6.3CVSS6.4AI score0.00226EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:35 p.m.25 views

praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

SummaryType: Insecure Direct Object Reference. The comment endpoints POST /workspaces/workspaceid/issues/issueid/comments and GET .../comments gate access on requireworkspacememberworkspaceid only, then call CommentService.createissueid=issueid, ... and CommentService.listforissueissueid without...

8.1CVSS6.2AI score0.00363EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.25 views

compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

Relevant Products/Components: trestle/core/commands/author/jinja.py trestle author jinja--- Detailed Description:The -o/--output argument in trestle author jinja allows writing files outside the intended workspace.The application does not properly validate: ../ ..\ absolute pathsThis allows...

8.4CVSS6.4AI score0.00232EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.25 views

local-deep-research has an SSRF bypass in `safe_get`

SummaryThe URL checking logic in local-deep-research has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. DetailsThe current project uses validateurl to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by...

5CVSS6.2AI score0.00247EPSS
SaveExploits0References10Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.25 views

pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API

SummaryThe SSRF mitigation added in commit 33c55da for GHSA-7gvf-3w72-p2pg is incomplete. The PREREQFUNCTION-based private IP check was correctly applied to HTTPChunk download path but not to HTTPRequest used by the parseurls API. An authenticated attacker can supply a URL pointing to an...

5CVSS6.2AI score0.00176EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.25 views

Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of...

8.7CVSS6.1AI score0.00156EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.25 views

NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

Summaryui.restructuredtext renders reStructuredText server-side with Docutils without disabling file insertion directives.When a NiceGUI application passes attacker-controlled content to ui.restructuredtext, an attacker can use standard Docutils directives include, csv-table with :file:, raw with...

7.5CVSS6.2AI score0.00255EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.25 views

CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

The cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted fingerprint value containing path traversal...

8.8CVSS6.2AI score0.00475EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.25 views

Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator

SummaryA path traversal vulnerability exists in Pipecat's development runner src/pipecat/runner/run.py. When the runner is started with the --folder flag, it exposes a GET /files/filename:path download endpoint. The filename path parameter is concatenated directly onto args.folder with no...

7.5CVSS7AI score0.00423EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.25 views

pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal

SummaryThe packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $div.htmlhtml. No escaping runs between the API value and innerHTML. An...

8.7CVSS6.2AI score0.00199EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.25 views

Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function

SummaryBlind server side request forgery SSRF via the PDF generate function. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here. Tested on Open...

5.4CVSS6.3AI score0.00186EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.25 views

wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API

Summary Any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own.The RoutinePermission class grants read access to any authenticated user when a routine has...

7.5CVSS6.1AI score0.00394EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:19 p.m.25 views

Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file

SummaryA missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. DetailsAll files/ related endpoints lack permission checks. Listing all filesFor example, let's see how file listing is...

8.1CVSS7AI score0.00273EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.25 views

mem0 server lacks authentication and authorization controls for its memory management API endpoints

The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints. Critical functions such as updating memory records PUT /memories/memoryid are exposed without any verification of the requester's identity or permissions. A remote attacker can exploit...

7.5CVSS6.2AI score0.00372EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.25 views

Superduper: Remote code execution via unsafe eval in superduper query parsing

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The parseoppart function in query.py uses the unsafe eval function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Although...

8.8CVSS6.6AI score0.00405EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.25 views

mem0 server lacks authentication and authorization controls for its memory creation API endpoint

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint POST /memories. The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending...

5.3CVSS6.2AI score0.00335EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.25 views

Snorkel MultitaskClassifier.load uses an unsafe torch.load

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability CWE-502 in the MultitaskClassifier.load method of the MultitaskClassifier class. The method loads model weight files using torch.load without enabling the security-restrictive weightsonly=True parameter. This...

8.8CVSS6.5AI score0.00392EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.25 views

GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration

SummaryThe programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and...

8.2CVSS6.2AI score0.00198EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.25 views

GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content

SummaryGuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape sequences into analyst terminals or CI logs...

5CVSS6.1AI score0.00113EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.25 views

Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels

Deactivated Channel Members Retain Full Access to Group/DM Channels Affected ComponentChannel membership authorization check:- backend/openwebui/models/channels.py lines 663-673, isuserchannelmember- Used at 15 locations in backend/openwebui/routers/channels.py Affected VersionsCurrent main branc...

5.4CVSS6.1AI score0.00178EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.25 views

Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled

Description OverviewWhen LDAP TLS is enabled LDAPUSETLS = True, Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the global ldap module level. This allows a man-in-the-middle attacker positioned between Lemur and the LDAP server to intercept all...

6.8CVSS6.2AI score0.00094EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.25 views

ciguard: Container image runs as root (no USER directive)

SummaryThe published ghcr.io/jo-jo98/ciguard container image inherits the default root user because the Dockerfile lacks a USER directive. ciguard is a static analyser with no need for root privileges; running as root inside a container makes any future container-runtime escape CVE more impactful...

3CVSS6.1AI score0.00122EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:15 p.m.25 views

Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input

SummaryA ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds measured on Apple M2, Python 3.14.3, with exponenti...

8.7CVSS6.2AI score0.00528EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 3:02 p.m.25 views

AstrBot Makes Use of Hard-coded Password

A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes/auth.py of the component Dashboard. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The...

7.5CVSS6.4AI score0.00288EPSS
SaveExploits0References9Affected Software1
PyPA
PyPA
added 2026/07/13 3:02 p.m.25 views

sqlite-mcp has an Injection issue

A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extracttojson of the file src/entry.py. Performing a manipulation of the argument outputfilename results in sql injection. Remote exploitation of the attack is possible. The exploit has been...

7.5CVSS6.7AI score0.00277EPSS
SaveExploits0References10Affected Software1
PyPA
PyPA
added 2026/07/13 3:02 p.m.25 views

OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface...

7.2CVSS6.2AI score0.00567EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:02 p.m.25 views

Langflow vulnerable to injection

A vulnerability was detected in langflow-ai langflow up to 1.8.3. The impacted element is the function getclientip/installmcpconfig of the file src/backend/base/langflow/api/v1/mcpprojects.py of the component Model Context Protocol Configuration API. Performing a manipulation of the argument...

6.5CVSS6.4AI score0.00232EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:02 p.m.25 views

Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

SummaryThe DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...

8.3CVSS6.3AI score0.00265EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:02 p.m.25 views

Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

SummaryThe DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...

8.3CVSS6.3AI score0.00265EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:02 p.m.25 views

Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/exposestacktraces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue...

7.5CVSS6.1AI score0.00449EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 3:02 p.m.25 views

UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable

uefi-firmware contains a stack out-of-bounds write vulnerability in the native tiano/EFI decompressor. in uefifirmware/compression/Tiano/Decompress.c, MakeTable does not validate that bit-length values read from the compressed bitstream are within the expected range 0..16. a crafted firmware blob...

9.8CVSS6.4AI score0.00434EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 3:02 p.m.25 views

UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen

uefi-firmware contains a heap out-of-bounds write vulnerability in the native tiano/EFI decompressor. in uefifirmware/compression/Tiano/Decompress.c, ReadCLen reads Number = GetBitsSd, CBIT with CBIT = 9, so Number can be as large as 511, while the destination array Sd-mCLen has NC = 510 elements...

9.8CVSS7AI score0.00434EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.25 views

PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands

SummaryThe approval system in PraisonAI Agents caches tool approval decisions by tool name only, not by invocation arguments. Once a user approves executecommand for any command e.g., ls -la, all subsequent executecommand calls in that execution context bypass the approval prompt entirely. Combin...

6.8CVSS6.3AI score0.00166EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.25 views

Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment

SummaryChatWorkflow.chatmessage passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal.The method name chat and parameter name message naturally...

8.8CVSS6.5AI score0.00611EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.25 views

python-ecdsa: Denial of Service via improper DER length validation in crafted private keys

SummaryAn issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions.1. ecdsa.der.removeoctetstring accepts truncated DER where the encoded length exceeds the available buffer. For example, an OCTET STRING that declares a length of 4096...

5.3CVSS6.1AI score0.00476EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.25 views

Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL

SummaryA Path Traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling thef...

7.1CVSS6.2AI score0.00336EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 2:36 p.m.25 views

Reverb use after free vulnerability

There exists a use after free vulnerability in Reverb.Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance...

7.8CVSS6.2AI score0.00123EPSS
SaveExploits0References6Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.25 views

OpenStack Cinder, glance, and Nova vulnerable to Path Traversal

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, a...

5.7CVSS6.7AI score0.01034EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.25 views

Segfault in `tf.raw_ops.TensorListConcat`

ImpactIf tf.rawops.TensorListConcat is given elementshape=, it results segmentation fault which can be used to trigger a denial of service attack.pythonimport tensorflow as tftf.rawops.TensorListConcat inputhandle=tf.data.experimental.tovarianttf.data.Dataset.fromtensorslices1, 2, 3,...

7.5CVSS6.9AI score0.00463EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.25 views

TensorFlow vulnerable to `CHECK` fail in `RandomPoissonV2`

ImpactWhen RandomPoissonV2 receives large input shape and rates, it gives a CHECK fail that can trigger a denial of service attack.pythonimport tensorflow as tfarg0=tf.random.uniformshape=4,, dtype=tf.int32, maxval=65536arg1=tf.random.uniformshape=4, 4, 4, 4, 4, dtype=tf.float32,...

7.5CVSS6.9AI score0.00478EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.25 views

TensorFlow vulnerable to `CHECK` fail in `AudioSummaryV2`

ImpactWhen AudioSummaryV2 receives an input samplerate with more than one element, it gives a CHECK fails that can be used to trigger a denial of service attack.pythonimport tensorflow as tfarg0=''arg1=tf.random.uniformshape=1,1, dtype=tf.float32, maxval=Nonearg2=tf.random.uniformshape=2,1,...

7.5CVSS6.9AI score0.00478EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.25 views

TensorFlow vulnerable to `CHECK` failure in `AvgPoolOp`

ImpactThe AvgPoolOp function takes an argument ksize that must be positive but is not checked. A negative ksize can trigger a CHECK failure and crash the program.pythonimport tensorflow as tfimport numpy as npvalue = np.ones1, 1, 1, 1ksize = 1, 1e20, 1, 1strides = 1, 1, 1, 1padding =...

7.5CVSS6.9AI score0.00721EPSS
SaveExploits0References8Affected Software1
PyPA
PyPA
added 2026/07/13 2:19 p.m.25 views

TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannel`

ImpactIf FakeQuantWithMinMaxVarsPerChannel is given min or max tensors of a rank other than one, it results in a CHECK fail that can be used to trigger a denial of service attack.pythonimport tensorflow as tfnumbits = 8narrowrange = Falseinputs = tf.constant0, shape=4, dtype=tf.float32min =...

7.5CVSS6.9AI score0.00478EPSS
SaveExploits0References7Affected Software1
PyPA
PyPA
added 2026/07/10 3:16 p.m.25 views

PYSEC-2026-3443

Crawl4AI before 0.8.7 contains a server-side request forgery SSRF vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, o...

9.2CVSS6.1AI score0.00513EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.25 views

Missing validation causes denial of service via `Conv3DBackpropFilterV2`

ImpactThe implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tftf.strings.unsortedsegmentjoin inputs='123', segmentids=0, numsegments=-1The...

5.5CVSS6.2AI score0.00349EPSS
SaveExploits1References13Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.25 views

Missing validation causes denial of service via `LoadAndRemapMatrix`

ImpactThe implementation of tf.rawops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tfckptpath = tf.constant "/tmp/warmstartingutiltest5kl2a3pc/tmpph76tep2/model-0"...

5.5CVSS6.2AI score0.0032EPSS
SaveExploits1References11Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.25 views

Plone unauthorized member addition vulnerability

Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator...

8.2CVSS6.6AI score0.02111EPSS
SaveExploits0References12Affected Software1
PyPA
PyPA
added 2026/07/09 4:49 p.m.25 views

Out-of-bounds Write in OpenCV

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0 corresponds with OpenCV-Python 4.1.0.25. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An...

8.8CVSS7.2AI score0.21108EPSS
SaveExploits1References9Affected Software1
Total number of security vulnerabilities5000