2024

Cross Site Scripting (XSS) vulnerability in Typora v.1.6.7 and before, allows a local attacker to obtain sensitive infor

Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbit

Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server auth

mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass

The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted director

A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval func

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to

mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary f

An issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to execute arbitrary code via

An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sendi

A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication

A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpo

vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its

lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signu

An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.

In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerabili

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. Th

An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, withi

An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, al

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact

A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smu

parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attack

An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functio

A path traversal vulnerability exists in the `_create_model_version()` function within `server/handlers.py` of the mlflo

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on th

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http

An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to sc

Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities.

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a def

A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository,

Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to a

Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to exe

Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain

A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send lar

A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web

An issue in Fireboltt Dream Wristphone BSW202_FB_AAC_v2.0_20240110-20240110-1956 allows attackers to cause a Denial of S

An input validation vulnerability exists in the Rockwell Automation 5015-AENFTXT that causes the secondary adapter to r

An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitr

A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web

A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web

A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web

Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts

HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfus

HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to imper

A vulnerability, which was classified as critical, has been found in Vesystem Cloud Desktop up to 20240408. This issue a

ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability

ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially