Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookD…

▾ Sunlitdagster-ge · dagster-geEPSS 0.55%via OSV

CVE-2025-51464Medium

1y ago

Aim vulnerable to Cross-site Scripting

▾ Sunlitaim · aimEPSS 0.61%via OSV

CVE-2025-54140High· 7.5

1y ago

`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write

▾ Twilightpyload-ng · pyload-ngEPSS 0.65%via OSV

CVE-2025-54121Medium· 5.3

1y ago

Starlette has possible denial-of-service vector when parsing large files in multipart forms

▾ Sunlitstarlette · starletteEPSS 0.58%via OSV

Tagged “pip”

Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability

pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)

copyparty allows Regex Denial of Service (ReDoS) in the upload listing

num2words subjected to phishing attack, two versions published containing malware

Malicious code in num2words (PyPI)

OpenEXR Out-Of-Memory via Unbounded File Header Values

MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit

OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

MaterialX Lack of MTLX Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion

OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size

MS SWIFT Remote Code Execution via unsafe PyYAML deserialization

copyparty Reflected XSS via Filter Parameter

MaterialX Null Pointer Dereference in MaterialXCore Shader Generation due to Unchecked implGraphOutput

MS SWIFT WEB-UI RCE Vulnerability

OpenEXR Out of Bounds Heap Read due to Bad Pointer Arithmetic in LossyDctDecoder_execute

MaterialX Null Pointer Dereference in getShaderNodes due to Unchecked nodeGraph->getOutput return

BentoML SSRF Vulnerability in File Upload Processing

Bugsink path traversal via event_id in ingestion

copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata

Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution

Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code

Skops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time

eKuiper API endpoints handling SQL queries with user-controlled table names.

Calibre Web and Autocaliweb have OS Command Injection vulnerability

Calibre Web and Autocaliweb have a ReDoS vulnerability

FastAPI Guard has a regex bypass

Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read a…

Aim vulnerable to Cross-site Scripting

`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write

Starlette has possible denial-of-service vector when parsing large files in multipart forms