Lucene search
+L
PypaMost viewed

7218 matches found

PyPA
PyPA
•added 2025/09/24 8:15 a.m.•15 views

PYSEC-2025-88

Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 before 2.0.5.Users are recommended to upgrade to version 2.0.5, which fixes the issue...

5.3CVSS5.8AI score0.00461EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2025/09/19 9:15 a.m.•15 views

PYSEC-2025-76

The Keras Model.loadmodelmethod can be exploited to achieve arbitrary code execution, even with safemode=True.One can create a specially crafted .kerasmodel archive that, when loaded via Model.loadmodel, will trigger arbitrary code to be executed. This is achieved by crafting a special config.jso...

8.6CVSS7.5AI score0.00186EPSS
SaveExploits0References2
PyPA
PyPA
•added 2025/07/29 8:15 p.m.•15 views

PYSEC-2025-101

An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollectinfooptions.log and syncgateway.log, there are cleartext passwords in redacted and unredacted output...

7.3CVSS5.8AI score0.00182EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2025/07/25 10:15 a.m.•15 views

PYSEC-2025-182

NULL Pointer Dereference in µD3TN via non-singleton destination Endpoint Identifier allows remote attacker to reliably cause DoS...

7.5CVSS5.8AI score0.0051EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2025/05/30 7:15 p.m.•15 views

PYSEC-2025-55

vLLM is an inference and serving engine for large language models LLMs. Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service ReDoS that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to...

6.5CVSS7AI score0.00472EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
•added 2025/05/26 5:15 a.m.•15 views

PYSEC-2025-176

A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile3DGSMDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approac...

5.5CVSS4.7AI score0.00218EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
•added 2025/05/26 4:15 a.m.•15 views

PYSEC-2025-175

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate3DGSMDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bound...

5.5CVSS4.7AI score0.00218EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
•added 2025/05/26 4:15 a.m.•15 views

PYSEC-2025-174

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The...

5.5CVSS4.7AI score0.00218EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
•added 2025/05/26 4:15 a.m.•15 views

PYSEC-2025-173

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to...

5.5CVSS4.6AI score0.00218EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
•added 2025/05/19 4:15 p.m.•15 views

PYSEC-2025-180

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype...

7.6CVSS5.9AI score0.00356EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
•added 2025/04/15 9:16 p.m.•15 views

PYSEC-2025-35

Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If, for example, the source code...

7.5CVSS7.2AI score0.0036EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2025/04/07 3:15 p.m.•15 views

PYSEC-2025-36

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrarycode...

9.8CVSS7.9AI score0.99996EPSS
SaveExploits34References4Affected Software1
PyPA
PyPA
•added 2025/04/02 1:15 p.m.•15 views

PYSEC-2025-14

An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.setlanguage are subject to a potential denial-of-service attack v...

7.5CVSS7AI score0.00997EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
•added 2025/03/25 9:15 p.m.•15 views

PYSEC-2025-114

A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file...

9.8CVSS6.2AI score0.00726EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2025/03/20 10:15 a.m.•15 views

PYSEC-2025-98

A Server-Side Request Forgery SSRF vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access th...

6.5CVSS6.8AI score0.00454EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2025/03/20 10:15 a.m.•15 views

PYSEC-2025-82

An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...

8.8CVSS7.2AI score0.00952EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2025/03/11 9:15 a.m.•15 views

PYSEC-2025-122

The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, ...

9.8CVSS6.7AI score0.02581EPSS
SaveExploits3References3Affected Software1
PyPA
PyPA
•added 2025/03/10 1:15 p.m.•15 views

PYSEC-2025-158

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated...

8.8CVSS6.8AI score0.00588EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
•added 2025/03/03 5:15 p.m.•15 views

PYSEC-2025-25

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

8.7CVSS6.7AI score0.00188EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2025/01/23 1:15 a.m.•15 views

PYSEC-2025-128

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blendtransformedtiledargb.isra.0...

6.5CVSS5.7AI score0.00393EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2024/11/22 8:15 p.m.•15 views

PYSEC-2024-310

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

5.3CVSS5.8AI score0.00634EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2024/11/21 2:15 p.m.•15 views

PYSEC-2024-295

A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bounds read and potential application crash...

6.2CVSS6.5AI score0.00303EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/11/18 3:15 p.m.•15 views

PYSEC-2024-313

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed...

8.2CVSS5.3AI score0.00442EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2024/10/28 2:15 p.m.•15 views

PYSEC-2024-299

Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block...

7.5CVSS5.8AI score0.00448EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/10/25 11:15 p.m.•15 views

PYSEC-2024-302

pyLoad is a free and open-source Download Manager. The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be...

9.1CVSS6.7AI score0.00682EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/09/26 4:15 p.m.•15 views

PYSEC-2024-291

Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function...

4.3CVSS5.8AI score0.00472EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/09/20 7:15 p.m.•15 views

PYSEC-2024-272

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All...

7.6CVSS5.9AI score0.00709EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
•added 2024/06/27 7:15 p.m.•15 views

PYSEC-2024-268

A Server-Side Request Forgery SSRF vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions = ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attackers to send crafted requests from the vulnerable server to internal or external resources, potential...

9.8CVSS7.1AI score0.00527EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/06/04 8:15 a.m.•15 views

PYSEC-2024-321

A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or...

9.1CVSS6.9AI score0.0169EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2024/05/16 9:15 a.m.•15 views

PYSEC-2024-244

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

7.5CVSS6.7AI score0.89716EPSS
SaveExploits2References5Affected Software1
PyPA
PyPA
•added 2024/05/14 4:17 p.m.•15 views

PYSEC-2024-264

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.Users are recommended to upgrade to version 2.9.1, which fixes this issue...

5.4CVSS6AI score0.01572EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2024/05/01 3:15 a.m.•15 views

PYSEC-2024-283

lunasvg v2.3.9 was discovered to contain an FPE Floating Point Exception at blendtransformedtiledargb.isra.0...

5.3CVSS5.8AI score0.00616EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/05/01 3:15 a.m.•15 views

PYSEC-2024-284

lunasvg v2.3.9 was discovered to contain a segmentation violation via the component compositionsolidsource...

5CVSS5.7AI score0.00297EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/03/14 7:15 p.m.•15 views

PYSEC-2024-315

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafeload function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file...

9.8CVSS6.1AI score0.00773EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
•added 2024/01/09 9:15 a.m.•15 views

PYSEC-2024-2

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a /.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials...

5.5CVSS6.6AI score0.00293EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2023/12/12 6:15 p.m.•15 views

PYSEC-2023-262

main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution...

9.8CVSS7.2AI score0.02565EPSS
SaveExploits3References6Affected Software1
PyPA
PyPA
•added 2023/10/23 5:15 p.m.•15 views

PYSEC-2023-319

WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange, which lead to segmentation fault...

5.5CVSS6AI score0.00205EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
•added 2023/09/29 9:14 p.m.•15 views

PYSEC-2023-184

opencv-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python-headless v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2...

8.8CVSS8.1AI score0.99735EPSS
SaveExploits9References3Affected Software1
PyPA
PyPA
•added 2023/09/29 9:14 p.m.•15 views

PYSEC-2023-181

opencv-contrib-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2...

8.8CVSS8.1AI score0.99735EPSS
SaveExploits9References3Affected Software1
PyPA
PyPA
•added 2023/03/10 2:15 a.m.•15 views

PYSEC-2023-316

WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::catcomputesize...

5.5CVSS6AI score0.00311EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2023/02/24 12:15 p.m.•15 views

PYSEC-2023-314

Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider.This issue affects Apache Airflow Sqoop Provider versions before 3.1.1...

9.8CVSS7.3AI score0.01895EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
•added 2023/01/31 10:15 a.m.•15 views

PYSEC-2023-5

Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database. This problem is fixed from version 0.13....

8.8CVSS7AI score0.01245EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
•added 2022/10/28 9:15 p.m.•15 views

PYSEC-2022-43187

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector::size at /bits/stlvector.h...

7.8CVSS7.1AI score0.00327EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2022/09/19 4:15 p.m.•15 views

PYSEC-2022-43074

The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

9.8CVSS7AI score0.01284EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2022/07/12 3:15 p.m.•15 views

PYSEC-2022-226

The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting XSS via the query string parameter q. In the case where it does not contain the http string, it is used to build the errormessage that is then rendered in the error.html template, using the flask.rendertemplate functio...

6.1CVSS6.4AI score0.00921EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2022/06/24 9:15 p.m.•15 views

PYSEC-2022-43073

The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS8AI score0.01941EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2022/06/09 1:15 p.m.•15 views

PYSEC-2022-206

OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...

6.5CVSS6.8AI score0.00443EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
•added 2022/05/20 7:15 p.m.•15 views

PYSEC-2022-43154

WASM3 v0.5.0 was discovered to contain a heap overflow via the component /wabt/bin/poc.wasm...

7.8CVSS7.6AI score0.0039EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2021/05/14 8:15 p.m.•15 views

PYSEC-2021-481

TensorFlow is an end-to-end open source platform for machine learning. An attacker can read data outside of bounds of heap allocated buffer in tf.rawops.QuantizeAndDequantizeV3. This is because the...

7.1CVSS7.1AI score0.00198EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2021/05/14 8:15 p.m.•15 views

PYSEC-2021-510

TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in tf.rawops.Dequantize, an attacker can trigger a read from outside of bounds of heap allocated data. The...

7.1CVSS6.9AI score0.00198EPSS
SaveExploits1References2Affected Software1
Total number of security vulnerabilities5000