Apache Airflow Common SQL Provider Vulnerable to SQL Injection

GHSA-5r62-mjf5-xwhj CVE-2025-30473 HIGH 8 months ago

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider. When usi...

pypi

No PRs yet

BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

GHSA-33xw-247w-6hmc CVE-2025-27520 CRITICAL 8 months ago

### Summary A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version(v1.4.2) of Ben...

pypi

No PRs yet

jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

GHSA-cj5w-8mjf-r5f8 CVE-2025-30370 HIGH 8 months ago

## Overview On many platforms, a third party can create a Git repository under a name that includes a shell command substitution [^1] string in th...

pypi

7

Dependabot PRs

42%

Merged

InternLM LMDeploy code injection vulnerability

GHSA-jfvg-qm4p-473x CVE-2025-3163 MODERATE 8 months ago

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open o...

pypi

No PRs yet

LMDeploy Improper Input Validation Vulnerability

GHSA-7vc5-mjwp-c8fq CVE-2025-3162 MODERATE 8 months ago

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been classified as critical. Affected is the function load_weight_ckpt of the fi...

pypi

No PRs yet

pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering

GHSA-2rrx-pphc-qfv9 CVE-2025-2946 CRITICAL 8 months ago

pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user...

pypi

No PRs yet

pgAdmin 4 Vulnerable to Remote Code Execution

GHSA-g73c-fw68-pwx3 CVE-2025-2945 CRITICAL 8 months ago

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 P...

pypi

No PRs yet

Django Potential Denial of Service (DoS) on Windows

GHSA-wqfg-m96j-85vm CVE-2025-27556 MODERATE 8 months ago

An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contr...

pypi

249

Dependabot PRs

1%

Merged

AWS SAM CLI Path Traversal allows file copy to local cache

GHSA-pp64-wj43-xqcr CVE-2025-3048 MODERATE 8 months ago

### Summary The [AWS Serverless Application Model Command Line Interface (AWS SAM CLI)](https://docs.aws.amazon.com/serverless-application-model/l...

pypi

No PRs yet

AWS SAM CLI Path Traversal allows file copy to build container

GHSA-px37-jpqx-97q9 CVE-2025-3047 MODERATE 8 months ago

### Summary The [AWS Serverless Application Model Command Line Interface (AWS SAM CLI)](https://docs.aws.amazon.com/serverless-application-model/l...

pypi

No PRs yet

Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding

GHSA-fcfq-m8p6-gw56 CVE-2025-31116 MODERATE 8 months ago

### Summary The latest deployed fix for the SSRF vulnerability is through the use of the call `valid_host()`. The code available at lines [/ae34f7...

pypi

No PRs yet

PyTorch susceptible to local Denial of Service

GHSA-3749-ghw9-m3mg CVE-2025-2953 LOW 8 months ago

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_ma...

pypi

No PRs yet

Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks

GHSA-f3mf-hm6v-jfhh CVE-2025-30358 HIGH 8 months ago

From @jackfromeast and @superboy-zjc: We have identified a class pollution vulnerability in Mesop (<= [0.14.0](https://github.com/mesop-dev/mesop/r...

pypi

No PRs yet

Synapse vulnerable to federation denial of service via malformed events

GHSA-v56r-hwv5-mxg6 CVE-2025-30355 HIGH 8 months ago

### Impact A malicious server can craft events with a `depth` outside the integer range allowed by Canonical JSON. When such an event is received b...

pypi

No PRs yet

Django TomSelect incomplete escaping of dangerous characters in widget attributes

GHSA-785h-76cm-cpmf LOW 8 months ago

### Summary User supplied values passed through to certain attributes in form widgets are not fully escaped for potentially dangerous tokens, and i...

pypi

No PRs yet

Frappe has possibility of SQL injection due to improper validations

GHSA-6phg-4wmq-h5h3 CVE-2025-30217 MODERATE 8 months ago

### Impact SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive informat...

pypi

No PRs yet

Frappe vulnerable to information disclosure leading to account takeover

GHSA-qrv3-jc3h-f3m6 CVE-2025-30214 HIGH 8 months ago

### Impact Making crafted requests could lead to information disclosure that could further lead to account takeover. ### Workarounds There's no wo...

pypi

No PRs yet

Frappe has Possibility of Remote Code Execution due to improper validation

GHSA-v342-4xr9-x3q3 CVE-2025-30213 MODERATE 8 months ago

### Impact A system user was able to create certain documents in a specific way that could lead to RCE. ### Workarounds There's no workaround, an ...

pypi

No PRs yet

Frappe has possibility of SQL injection due to improper validations

GHSA-3hj6-r5c9-q8f3 CVE-2025-30212 MODERATE 8 months ago

### Impact An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive informati...

pypi

No PRs yet

InvokeAI Deserialization of Untrusted Data vulnerability

GHSA-mcrp-whpw-jp68 CVE-2024-12029 CRITICAL 8 months ago

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerabili...

pypi

No PRs yet

MLflow Cross-Site Request Forgery (CSRF) vulnerability

GHSA-969w-gqqr-g6j3 CVE-2025-1473 MODERATE 8 months ago

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allow...

pypi

No PRs yet

MLflow has Weak Password Requirements

GHSA-4rj2-9gcx-5qhx CVE-2025-1474 LOW 8 months ago

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security ...

pypi

No PRs yet

Aim Excessive Data Query Operations in a Large Data Table vulnerability

GHSA-fm93-g6xp-35xq CVE-2025-0190 HIGH 8 months ago

In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them si...

pypi

No PRs yet

Aim Uncontrolled Resource Consumption vulnerability

GHSA-j5qj-rg5j-j7c2 CVE-2025-0189 HIGH 8 months ago

In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for webso...

pypi

No PRs yet

LiteLLM Has an Improper Authorization Vulnerability

GHSA-fjcf-3j3r-78rp CVE-2025-0628 HIGH 8 months ago

An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_viewer' logs...

pypi

No PRs yet

SageMaker Workflow component allows possibility of MD5 hash collisions

GHSA-32g6-mg92-ghm2 CVE-2025-0508 MODERATE 8 months ago

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. ...

pypi

No PRs yet

LiteLLM Has a Leakage of Langfuse API Keys

GHSA-879v-fggm-vxw2 CVE-2025-0330 HIGH 8 months ago

In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team set...

pypi

No PRs yet

MLflow Uncontrolled Resource Consumption vulnerability

GHSA-49m6-vrr9-2cqm CVE-2025-0453 MODERATE 8 months ago

In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queri...

pypi

No PRs yet

ZenML unauthenticated DoS via Multipart Boundry

GHSA-6gmf-2369-c76c CVE-2024-9340 HIGH 8 months ago

A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption b...

pypi

No PRs yet

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability

GHSA-5ccf-884p-4jjq HIGH 8 months ago

A Denial of Service (DoS) vulnerability exists in open-webui/open-webui version 0.3.21. This vulnerability affects multiple endpoints, including `/...

npm pypi

No PRs yet

Kedro deserialization vulnerability

GHSA-747f-ww56-4q4h CVE-2024-9701 CRITICAL 8 months ago

A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8). This vulnerability allows an attac...

pypi

No PRs yet

LiteLLM Reveals Portion of API Key via a Logging File

GHSA-g5pg-73fc-hjwq CVE-2024-9606 HIGH 8 months ago

In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key mask...

pypi

No PRs yet

Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary

GHSA-m76r-xqqj-mqmv CVE-2024-9229 HIGH 8 months ago

A Denial of Service (DoS) vulnerability in the file upload feature of stangirard/quivr v0.0.298 allows unauthenticated attackers to cause excessive...

pypi

No PRs yet

BentoML deserialization vulnerability

GHSA-9g44-gwvm-hc44 CVE-2024-9070 CRITICAL 8 months ago

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an att...

pypi

No PRs yet

BentoML Denial of Service (DoS) via Multipart Boundary

GHSA-hw8j-hw49-752c CVE-2024-9056 HIGH 8 months ago

BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as ...

pypi

No PRs yet

vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints

GHSA-cj47-qj6g-x7r4 CVE-2024-9053 CRITICAL 8 months ago

vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_lo...

pypi

No PRs yet

vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

GHSA-pgr7-mhp5-fgjp CVE-2024-9052 CRITICAL 8 months ago

vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_objec...

pypi

No PRs yet

Composio Eval Injection Vulnerability

GHSA-5xg7-5662-8x7j CVE-2024-8953 HIGH 8 months ago

In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This...

pypi

No PRs yet

LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

GHSA-fh2c-86xm-pm2x CVE-2024-8984 HIGH 8 months ago

A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, suc...

pypi

No PRs yet

composio Server-Side Request Forgery (SSRF) vulnerability

GHSA-qvg9-vp87-h3hr CVE-2024-8952 MODERATE 8 months ago

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_S...

pypi

No PRs yet

composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL

GHSA-38mg-wm59-g64x CVE-2024-8955 MODERATE 8 months ago

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the ...

pypi

No PRs yet

Gradio DOS in multipart boundry while uploading the file

GHSA-5cpq-9538-jm2j CVE-2024-8966 HIGH 8 months ago

A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attack...

pypi

No PRs yet

MLflow has a Local File Read/Path Traversal in dbfs

GHSA-4rqf-8pfm-p36r CVE-2024-8859 HIGH 8 months ago

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directl...

pypi

No PRs yet

AgentScope directory traversal vulnerability in /read-examples

GHSA-6v28-q95m-93qr CVE-2024-8524 HIGH 8 months ago

A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSO...

pypi

No PRs yet

AgentScope Cross-Origin Resource Sharing (CORS) vulnerability

GHSA-75v5-6885-59f9 CVE-2024-8487 HIGH 8 months ago

A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope serve...

pypi

No PRs yet

AgentScope Path Traversal in /api/file

GHSA-f4hc-q562-cc5r CVE-2024-8438 HIGH 8 months ago

A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` ...

pypi

No PRs yet

AgentScope stored cross-site scripting (XSS) vulnerability

GHSA-6mf6-7j75-2m6f CVE-2024-8556 MODERATE 8 months ago

A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerab...

pypi

No PRs yet

AgentScope path traversal vulnerability

GHSA-c4cc-w454-4634 CVE-2024-8537 CRITICAL 8 months ago

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete...

pypi

No PRs yet

AgentScope Deserialization Vulnerability

GHSA-9w5h-67gf-xvv8 CVE-2024-8502 CRITICAL 8 months ago

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of...

pypi

No PRs yet

AgentScope path traversal vulnerability in save-workflow

GHSA-j9rw-qm5f-r8xm CVE-2024-8551 CRITICAL 8 months ago

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This...

pypi

No PRs yet