Lucene search
+L
PypaMost viewed

7586 matches found

PyPA
PyPA
•added 2025/06/13 2:15 p.m.•15 views

PYSEC-2025-256

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

7.5CVSS6.2AI score0.00886EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
•added 2025/05/26 8:15 a.m.•15 views

PYSEC-2025-46

A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py. The manipulation leads to improper authorization. Attacking locally is a requirement. The exploit has been disclosed to the public and m...

5.5CVSS6.6AI score0.00236EPSS
SaveExploits1References18Affected Software1
PyPA
PyPA
•added 2025/04/06 8:15 p.m.•15 views

PYSEC-2025-16

LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery SSRF vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request ...

9.3CVSS7.2AI score0.00636EPSS
SaveExploits2References2Affected Software1
PyPA
PyPA
•added 2025/04/03 2:15 p.m.•15 views

PYSEC-2025-263

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buff...

7.8CVSS5.8AI score0.00328EPSS
SaveExploits1References7Affected Software1
PyPA
PyPA
•added 2025/03/31 9:15 p.m.•15 views

PYSEC-2025-262

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument...

6.5CVSS5.6AI score0.00623EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
•added 2025/03/10 2:15 p.m.•15 views

PYSEC-2025-22

A vulnerability, that could result in Remote Code Execution RCE, has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code.Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting th...

9.8CVSS7.8AI score0.01048EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
•added 2025/03/06 5:15 a.m.•15 views

PYSEC-2025-23

Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only...

6.4CVSS7AI score0.00192EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
•added 2025/02/21 10:15 p.m.•15 views

PYSEC-2025-31

vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the...

9.1CVSS6.8AI score0.0057EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2025/01/29 9:15 p.m.•15 views

PYSEC-2025-26

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the...

7CVSS7.8AI score0.00306EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2025/01/29 9:15 p.m.•15 views

PYSEC-2025-28

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential...

5.5CVSS7AI score0.0014EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
•added 2025/01/23 1:15 a.m.•15 views

PYSEC-2025-133

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component grayrecordcell...

6.5CVSS5.7AI score0.00349EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2025/01/23 1:15 a.m.•15 views

PYSEC-2025-132

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component compositionsourceover...

6.5CVSS5.7AI score0.00349EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2025/01/14 7:15 p.m.•15 views

PYSEC-2025-118

Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This...

8.7CVSS5.8AI score0.00983EPSS
SaveExploits1References1Affected Software1
PyPA
PyPA
•added 2024/12/10 7:19 p.m.•15 views

A number of releases of ultralytics contained malicious crypto miner software.

Ultralytics has identified a supply chain attackaffecting affecting multiple versions of the ultralytics package.The compromised versions contained unauthorized code thatdownloaded and executed cryptocurrency mining softwarewhen instantiating YOLO models.This code was injected into the PyPI relea...

8.7CVSS7.2AI score
SaveExploits0References7Affected Software1
PyPA
PyPA
•added 2024/12/06 12:15 p.m.•15 views

PYSEC-2024-157

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...

9.8CVSS8AI score0.01415EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2024/11/25 2:15 p.m.•15 views

PYSEC-2024-224

Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf MLflow API is called...

7CVSS6.9AI score0.00121EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2024/11/22 10:15 p.m.•15 views

PYSEC-2024-228

Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability...

8.8CVSS7.7AI score0.03074EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2024/11/22 10:15 p.m.•15 views

PYSEC-2024-229

Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th...

8.8CVSS7.7AI score0.02566EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2024/10/29 1:15 p.m.•15 views

PYSEC-2024-112

An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. An attacker can read any file that matches specific criteria using an absolute path. The file must not have a .json extension and, except f...

7.5CVSS7AI score0.00792EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
•added 2024/10/10 11:15 p.m.•15 views

PYSEC-2024-199

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response ti...

3.7CVSS6.7AI score0.00292EPSS
SaveExploits0References1Affected Software1
PyPA
PyPA
•added 2024/09/22 2:15 a.m.•15 views

PYSEC-2024-325

A stored cross-site scripting XSS vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated user can inject arbitrary JavaScript or HTML into the "Top banner" field. NOTE: Multiple third parties...

5.4CVSS6.2AI score0.00309EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2024/09/17 7:15 p.m.•15 views

PYSEC-2024-93

A vulnerability was found in MicroPython 1.23.0. It has been classified as critical. Affected is the function mpvfsumount of the file extmod/vfs.c of the component VFS Unmount Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit...

7.5CVSS7.4AI score0.01015EPSS
SaveExploits1References8Affected Software1
PyPA
PyPA
•added 2024/09/07 8:15 a.m.•15 views

PYSEC-2024-266

Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the...

8.8CVSS6.1AI score0.01237EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2024/08/22 8:15 p.m.•15 views

PYSEC-2024-192

An issue was discovered in llamaindex before 0.10.38. download/integration.py includes an exec call for import clsname...

8.8CVSS7AI score0.00533EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
•added 2024/08/20 3:15 p.m.•15 views

PYSEC-2024-72

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. This vulnerability is fixed in 1.14.2...

8.8CVSS7.9AI score0.00894EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
•added 2024/08/08 3:15 p.m.•15 views

PYSEC-2024-200

JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the admin:users scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that...

7.2CVSS7.2AI score0.0059EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2024/07/31 1:15 a.m.•15 views

PYSEC-2024-73

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as config.json and dsconfigchatbot.json. This issue arises due to improper validation of file paths, enabling...

9.1CVSS6.9AI score0.13092EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
•added 2024/07/24 6:15 p.m.•15 views

PYSEC-2024-203

DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other...

7.5CVSS7.4AI score0.00813EPSS
SaveExploits1References5Affected Software1
PyPA
PyPA
•added 2024/07/17 8:15 p.m.•15 views

PYSEC-2024-65

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

5.4CVSS6.4AI score0.00327EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2024/07/11 11:15 a.m.•15 views

PYSEC-2024-61

A Stored Cross-Site Scripting XSS vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser...

7.4CVSS5.6AI score0.00371EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2024/07/10 5:15 a.m.•15 views

PYSEC-2024-59

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. getsupportedlanguagevariant was subject to a potential denial-of-service attack when used with very long strings containing specific characters...

7.5CVSS8.2AI score0.28637EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2024/06/24 6:15 p.m.•15 views

PYSEC-2024-54

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to the server endpoint of CodeChecker store are not properly sanitized. An attacker, using a path traversal attack, can load and display files on the machine o...

6.5CVSS6.6AI score0.0073EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
•added 2024/06/16 3:15 p.m.•15 views

PYSEC-2024-53

langchainexperimental aka LangChain Experimental before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444...

9.8CVSS7AI score0.00773EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2024/06/12 3:15 p.m.•15 views

PYSEC-2024-98

UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Submarine Server Core.This issue affects Apache Submarine Server Core: from 0.8.0.As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restri...

9.8CVSS6.9AI score0.00744EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2024/06/06 7:15 p.m.•15 views

PYSEC-2024-169

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the active status of user accounts to false,...

6.5CVSS6.6AI score0.00628EPSS
SaveExploits1References6Affected Software1
PyPA
PyPA
•added 2024/06/06 6:15 p.m.•15 views

PYSEC-2024-184

A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the postprocess function within gradio/components/jsoncomponent.py, where a user-controlled string is parsed as JSON. If the parsed JSON...

7.5CVSS6.6AI score0.0083EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2024/04/17 7:15 p.m.•15 views

PYSEC-2024-251

Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp...

7.8CVSS7.3AI score0.00268EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2024/04/10 5:15 p.m.•15 views

PYSEC-2024-316

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the config.json file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys...

7.5CVSS7AI score0.00785EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2024/03/20 8:15 p.m.•15 views

PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

9.8CVSS7.6AI score0.0103EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
•added 2024/03/15 8:15 p.m.•15 views

PYSEC-2024-47

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words method with html=True and the truncatewordshtml template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because ...

5.3CVSS7.5AI score0.01854EPSS
SaveExploits0References4Affected Software1
PyPA
PyPA
•added 2024/03/14 7:15 p.m.•15 views

PYSEC-2024-314

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafeload function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file...

9.8CVSS6.2AI score0.00779EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
•added 2024/02/12 11:15 p.m.•15 views

PYSEC-2024-107

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exiv2 version v0.28.1: an unbounded recursion can cause Exiv2 to crash by exhausting the stack. The vulnerable function,...

5.5CVSS6.4AI score0.0022EPSS
SaveExploits0References2Affected Software1
PyPA
PyPA
•added 2024/02/07 5:15 p.m.•15 views

PYSEC-2024-150

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an int as an index for an array. The typechecker allows the usage of...

9.8CVSS6.8AI score0.01539EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2024/02/02 5:15 a.m.•15 views

PYSEC-2024-35

Versions of the package dash-core-components before 2.13.0; all versions of the package dash-core-components; versions of the package dash before 2.15.0; all versions of the package dash-html-components; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site...

6.5CVSS6.2AI score0.01487EPSS
SaveExploits1References17Affected Software1
PyPA
PyPA
•added 2024/01/31 6:15 p.m.•15 views

PYSEC-2024-29

OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an adm...

4.9CVSS6.8AI score0.00519EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2024/01/31 5:15 p.m.•15 views

PYSEC-2024-127

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

5.3CVSS6.8AI score0.00737EPSS
SaveExploits1References4Affected Software1
PyPA
PyPA
•added 2024/01/22 1:15 a.m.•15 views

PYSEC-2024-12

LlamaIndex aka llamaindex through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro...

9.8CVSS8AI score0.0066EPSS
SaveExploits1References2Affected Software1
PyPA
PyPA
•added 2024/01/19 8:15 p.m.•15 views

PYSEC-2024-15

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch//history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party...

3.7CVSS6.7AI score0.00587EPSS
SaveExploits1References3Affected Software1
PyPA
PyPA
•added 2024/01/03 9:15 a.m.•15 views

PYSEC-2024-146

PaddlePaddle before 2.6.0 has a command injection in convertshapecompare. This resulted in the ability to execute arbitrary commands on the operating system...

9.8CVSS8.2AI score0.01182EPSS
SaveExploits0References3Affected Software1
PyPA
PyPA
•added 2024/01/03 9:15 a.m.•15 views

PYSEC-2024-129

FPE in paddle.nanmedian in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service...

7.5CVSS6.8AI score0.00488EPSS
SaveExploits0References3Affected Software1
Total number of security vulnerabilities5000