High
CVE-2024-29190
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Low
ghsa-cq96-9974-v8hm
Dynamic Variable Evaluation in qiskit-ibm-runtime
Critical
CVE-2024-28179
Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server
Medium
CVE-2024-21503
Black vulnerable to Regular Expression Denial of Service (ReDoS)
Medium
CVE-2024-28237
XSS via the "Snapshot Test" feature in Classic Webcam plugin settings
Medium
CVE-2024-27351
Regular expression denial-of-service in Django
Low
ghsa-879p-8gw4-mcpw
fgr Vulnerable to Insecure Default Variable Initialization
Critical
CVE-2024-22203
Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and
Critical
CVE-2024-22205
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location` variable and passes it to the `send` met
Medium
CVE-2024-22204
Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The `config` function in `app
Medium
CVE-2024-22417
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and
High
CVE-2024-28425
greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability allows attackers to execute arbitrary code v
Medium
CVE-2024-23823
vantage6's CORS settings overly permissive
Medium
CVE-2024-28746
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which t
Medium
CVE-2024-27305
aiosmtpd vulnerable to SMTP smuggling
High
CVE-2024-27758
RPyC's missing security check results in code execution when using numpy.array on the server-side.
Critical
CVE-2024-2044
pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user
Medium
ghsa-3qwc-47jf-5rf7
eth-abi is vulnerable to recursive DoS
Low
CVE-2024-28088
LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading con
Medium
CVE-2024-26280
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permit
Critical
CVE-2024-2057
A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/
Medium
CVE-2024-27906
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.
Medium
CVE-2024-24779
Apache Superset: Improper data authorization when creating a new dataset
Medium
CVE-2024-26016
Apache Superset: Improper authorization validation on dashboards and charts import
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.