Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file.

▾ Midnightairflow-diagrams · airflow-diagramsEPSS 0.78%via OSV

CVE-2024-27097Medium· 4.3

2y ago

Potential log injection in reset user endpoint in CKAN

▾ Sunlitckan · ckanEPSS 0.44%via OSV

CVE-2024-26164High· 8.8

2y ago

Remote Code Execution Vulnerability in Microsoft Django Backend for SQL Server

▾ Twilightmssql-django · mssql-djangoEPSS 2.1%via OSV

CVE-2024-52288Medium· 5.1

2y ago

LibOSDP RMAC revert to the beginning of the session

▾ Sunlitlibosdp · libosdpEPSS 0.13%via OSV

CVE-2024-2319Medium· 5.4

2y ago

Django MarkdownX Cross-Site Scripting (XSS) vulnerability

▾ Sunlitdjango-markdownx · django-markdownxEPSS 0.39%via OSV

Tagged “pip”

Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check

pgAdmin Remote Code Execution (RCE) vulnerability

Pillow buffer overflow vulnerability

Voilà Local file inclusion

Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Saleor: Customers' addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method

Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing

gradio Server-Side Request Forgery vulnerability

LangChain's XMLOutputParser vulnerable to XML Entity Expansion

Unauthenticated views may expose information to anonymous users

Apache Airflow Improper Preservation of Permissions vulnerability

ansys-geometry-core OS Command Injection vulnerability

PaddlePaddle allows arbitrary file read via paddle.vision.ops.read_file

SSRF Vulnerability on assetlinks_check(act_name, well_knowns)

ESPHome vulnerable to Authentication bypass via Cross site request forgery

`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code

GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

Black vulnerable to Regular Expression Denial of Service (ReDoS)

Denial of service via regular expression

Information leakage in YAQL

RCE in TranformGraph().to_dot_graph function

Improper Privilege Management in djangorestframework-simplejwt

Regular expression denial-of-service in Django

vantage6 vulnerable to a username timing attack on recover password/MFA token

vantage6's CORS settings overly permissive

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vuln…

Potential log injection in reset user endpoint in CKAN

Remote Code Execution Vulnerability in Microsoft Django Backend for SQL Server

LibOSDP RMAC revert to the beginning of the session

Django MarkdownX Cross-Site Scripting (XSS) vulnerability