Lucene search
+L
PypaMost viewed

7218 matches found

PyPA
PyPA
•added 2026/02/03 3:16 p.m.•15 views

PYSEC-2026-44

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.Raster lookups on RasterField only implemented on PostGIS allows remote attackers to inject SQL via the band index parameter.Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated...

5.4CVSS7.4AI score0.12976EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2026/02/03 3:16 p.m.•15 views

PYSEC-2026-43

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers.Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not...

7.5CVSS7.1AI score0.00993EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2026/01/30 11:16 p.m.•15 views

PYSEC-2026-114

OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with path traversal sequences e.g., '../' in the URL. For example, requesting...

7.5CVSS7.4AI score0.0098EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2026/01/30 7:16 p.m.•15 views

PYSEC-2026-62

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the topostgis function being used to write GeoDataFrames to a PostgreSQL database...

8.6CVSS5.8AI score0.00385EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2026/01/22 5:16 p.m.•15 views

PYSEC-2026-107

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents...

7.5CVSS5.8AI score0.0055EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
•added 2026/01/12 11:15 p.m.•15 views

PYSEC-2026-85

LlamaIndex run-llama/llamaindex versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.loadfromdisk in llamaindex/indices/managed/bgem3/base.py. The function uses pickle.load to deserialize multiembedstore.pkl from a user-supplied persistdir without...

8.4CVSS6.3AI score0.00274EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2025/12/23 9:15 p.m.•15 views

PYSEC-2025-216

Hugging Face Transformers HuBERT convertconfig Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the...

7.8CVSS7.6AI score0.00289EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
•added 2025/12/16 1:15 a.m.•15 views

PYSEC-2025-233

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue...

4.3CVSS5.8AI score0.00244EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
•added 2025/12/02 4:15 p.m.•15 views

PYSEC-2025-109

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.Algorithmic complexity in django.core.serializers.xmlserializer.getInnerText allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML...

7.5CVSS7.3AI score0.02116EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2025/11/21 7:16 p.m.•15 views

PYSEC-2025-139

MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::loadgguf when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This iss...

7.5CVSS5.7AI score0.0037EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2025/10/05 1:15 a.m.•15 views

PYSEC-2025-155

A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation causes allocation of resources. The attack is restricted to local execution. The exploit has been...

5.5CVSS5.4AI score0.00189EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
•added 2025/09/24 8:15 a.m.•15 views

PYSEC-2025-88

Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 before 2.0.5.Users are recommended to upgrade to version 2.0.5, which fixes the issue...

5.3CVSS5.8AI score0.00461EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2025/09/19 9:15 a.m.•15 views

PYSEC-2025-76

The Keras Model.loadmodelmethod can be exploited to achieve arbitrary code execution, even with safemode=True.One can create a specially crafted .kerasmodel archive that, when loaded via Model.loadmodel, will trigger arbitrary code to be executed. This is achieved by crafting a special config.jso...

8.6CVSS7.5AI score0.00186EPSS
SaveExploits0References2
PyPA
PyPA
•added 2025/09/09 12:15 a.m.•15 views

PYSEC-2025-140

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. The extractall function zipfile.extractalloutputdir is used directly to process compressed files. It is used in many places in the project. In versions up to and including 1.5.0, when the Zip file containing malicious...

8.8CVSS5.7AI score0.00614EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2025/07/29 8:15 p.m.•15 views

PYSEC-2025-101

An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollectinfooptions.log and syncgateway.log, there are cleartext passwords in redacted and unredacted output...

7.3CVSS5.8AI score0.00182EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2025/07/25 10:15 a.m.•15 views

PYSEC-2025-182

NULL Pointer Dereference in µD3TN via non-singleton destination Endpoint Identifier allows remote attacker to reliably cause DoS...

7.5CVSS5.8AI score0.0051EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2025/06/13 2:15 p.m.•15 views

PYSEC-2025-255

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers...

7.5CVSS6.1AI score0.00437EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
•added 2025/05/30 7:15 p.m.•15 views

PYSEC-2025-55

vLLM is an inference and serving engine for large language models LLMs. Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service ReDoS that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to...

6.5CVSS7AI score0.00472EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
•added 2025/05/26 5:15 a.m.•15 views

PYSEC-2025-176

A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile3DGSMDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approac...

5.5CVSS4.7AI score0.00218EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
•added 2025/05/26 4:15 a.m.•15 views

PYSEC-2025-175

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate3DGSMDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bound...

5.5CVSS4.7AI score0.00218EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
•added 2025/05/26 4:15 a.m.•15 views

PYSEC-2025-174

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The...

5.5CVSS4.7AI score0.00218EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
•added 2025/05/26 4:15 a.m.•15 views

PYSEC-2025-173

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to...

5.5CVSS4.6AI score0.00218EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
•added 2025/05/19 4:15 p.m.•15 views

PYSEC-2025-180

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype...

7.6CVSS5.9AI score0.00378EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
•added 2025/04/15 9:16 p.m.•15 views

PYSEC-2025-35

Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If, for example, the source code...

7.5CVSS7.2AI score0.0036EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2025/04/07 3:15 p.m.•15 views

PYSEC-2025-36

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrarycode...

9.8CVSS7.9AI score0.99996EPSS
SaveExploits35References4Affected Software1
PyPA
PyPA
•added 2025/04/02 1:15 p.m.•15 views

PYSEC-2025-14

An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.setlanguage are subject to a potential denial-of-service attack v...

7.5CVSS7AI score0.00997EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
•added 2025/03/25 9:15 p.m.•15 views

PYSEC-2025-114

A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file...

9.8CVSS6.2AI score0.00726EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2025/03/20 10:15 a.m.•15 views

PYSEC-2025-98

A Server-Side Request Forgery SSRF vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access th...

6.5CVSS6.8AI score0.00454EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2025/03/20 10:15 a.m.•15 views

PYSEC-2025-82

An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...

8.8CVSS7.2AI score0.00952EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2025/03/20 10:15 a.m.•15 views

PYSEC-2025-80

A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint /api/file does not properly sanitize the path parameter, allowing an attacker to read arbitrary files on the server...

7.5CVSS7.2AI score0.00713EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2025/03/11 9:15 a.m.•15 views

PYSEC-2025-122

The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, ...

9.8CVSS6.7AI score0.02581EPSS
SaveExploits3References3Affected Software1
PyPA
PyPA
•added 2025/03/10 2:15 p.m.•16 views

PYSEC-2025-159

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The...

9.8CVSS6.8AI score0.0052EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
•added 2025/03/03 5:15 p.m.•15 views

PYSEC-2025-25

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

8.7CVSS6.7AI score0.00188EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2025/01/23 1:15 a.m.•15 views

PYSEC-2025-128

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blendtransformedtiledargb.isra.0...

6.5CVSS5.7AI score0.00393EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2024/11/22 8:15 p.m.•15 views

PYSEC-2024-310

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

5.3CVSS5.8AI score0.00634EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2024/10/28 2:15 p.m.•15 views

PYSEC-2024-299

Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block...

7.5CVSS5.8AI score0.00448EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/10/25 11:15 p.m.•15 views

PYSEC-2024-302

pyLoad is a free and open-source Download Manager. The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be...

9.1CVSS6.7AI score0.00682EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/09/26 4:15 p.m.•15 views

PYSEC-2024-291

Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function...

4.3CVSS5.8AI score0.00472EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/09/20 7:15 p.m.•15 views

PYSEC-2024-272

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All...

7.6CVSS5.9AI score0.00709EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
•added 2024/06/27 7:15 p.m.•15 views

PYSEC-2024-268

A Server-Side Request Forgery SSRF vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions = ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attackers to send crafted requests from the vulnerable server to internal or external resources, potential...

9.8CVSS7.1AI score0.00527EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/06/06 7:15 p.m.•15 views

PYSEC-2024-242

A Local File Inclusion LFI vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can...

7.5CVSS6.5AI score0.21847EPSS
SaveExploits2References6Affected Software1
PyPA
PyPA
•added 2024/06/04 8:15 a.m.•15 views

PYSEC-2024-321

A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or...

9.1CVSS6.9AI score0.0169EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2024/05/16 9:15 a.m.•15 views

PYSEC-2024-267

A Local File Inclusion LFI vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to improper input validation when handling file paths during the chat history upload process. An attacker c...

7.5CVSS7.3AI score0.00597EPSS
SaveExploits2References1Affected Software1
PyPA
PyPA
•added 2024/05/14 4:17 p.m.•15 views

PYSEC-2024-264

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.Users are recommended to upgrade to version 2.9.1, which fixes this issue...

5.4CVSS6AI score0.01572EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2024/05/01 3:15 a.m.•15 views

PYSEC-2024-283

lunasvg v2.3.9 was discovered to contain an FPE Floating Point Exception at blendtransformedtiledargb.isra.0...

5.3CVSS5.8AI score0.00616EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/03/14 7:15 p.m.•15 views

PYSEC-2024-315

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafeload function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file...

9.8CVSS6.1AI score0.00773EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
•added 2024/01/09 9:15 a.m.•15 views

PYSEC-2024-2

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a /.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials...

5.5CVSS6.6AI score0.00293EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2023/12/12 6:15 p.m.•15 views

PYSEC-2023-262

main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution...

9.8CVSS7.2AI score0.02565EPSS
SaveExploits3References6Affected Software1
PyPA
PyPA
•added 2023/10/23 5:15 p.m.•15 views

PYSEC-2023-319

WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange, which lead to segmentation fault...

5.5CVSS6AI score0.00205EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
•added 2023/09/29 9:14 p.m.•15 views

PYSEC-2023-181

opencv-contrib-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2...

8.8CVSS8.1AI score0.99735EPSS
SaveExploits9References3Affected Software1
Total number of security vulnerabilities5000