Medium
CVE-2024-23637
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,359
Reset filters
Medium
CVE-2023-47116
Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections
Medium
CVE-2024-24567
Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
Low
CVE-2024-21671
vantage6 vulnerable to username timing attack
Medium
CVE-2024-21653
vantage6 has insecure SSH configuration for node and server containers
Medium
CVE-2024-23829
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
High
CVE-2024-23334
aiohttp is vulnerable to directory traversal
High
CVE-2024-0936
A vulnerability classified as critical was found in van_der_Schaar LAB TemporAI 0.0.3. Affected by this vulnerability is the function load_from_file of the component PKL File Handler. The manipulation
Medium
CVE-2023-51702
Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
High
CVE-2023-50943
Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting r
High
CVE-2023-50944
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low s
Medium
CVE-2024-23633
Cross-site Scripting Vulnerability on Data Import
High
CVE-2023-47115
Cross-site Scripting Vulnerability on Avatar Upload
Medium
CVE-2024-23341
html injection vulnerability in the `tuitse_html` function.
Critical
CVE-2024-23752
Code execution in pandasai
Critical
CVE-2024-23751
LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorS
Medium
CVE-2024-23732
The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py.
Critical
CVE-2024-23731
The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument.
Low
CVE-2024-23329
changedetection.io API endpoint is not secured with API token
High
CVE-2024-22419
concat built-in can corrupt memory in vyper
Medium
ghsa-xgfm-fjx6-62mj
readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects
Medium
ghsa-8qw9-gf7w-42x5
Minor fix to previous patch for CVE-2022-35918
Low
CVE-2024-22194
cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code
High
CVE-2024-22190
Untrusted search path under some conditions on Windows allows arbitrary code execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.