High
CVE-2023-36827
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
High
CVE-2023-34457
MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form
Medium
CVE-2023-25399
A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.
Critical
CVE-2023-36258
An issue in langchain v.0.0.199 allows an attacker to execute arbitrary code via the PALChain in the python exec method.
High
CVE-2023-36814
Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
High
CVE-2023-36053
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large numb
Critical
CVE-2023-35797
Apache Airflow Hive Provider Beeline remote code execution with Principal
Critical
CVE-2023-31543
A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.
Unrated
CVE-2023-37360
pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security pro
High
CVE-2020-26708
requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
High
CVE-2020-26710
easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
High
CVE-2020-26709
py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
Low
ghsa-373w-rj84-pv6x
SafeURL-Python's hostname blocklist does not block FQDNs
Medium
CVE-2023-35798
Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability
Critical
ghsa-hj8m-9fhf-v7jp
fief-server Server-Side Template Injection vulnerability
Medium
CVE-2023-34110
Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error
Critical
CVE-2023-34541
Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt.
High
CVE-2023-35005
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.
Critical
CVE-2023-34540
Langchain 0.0.171 is vulnerable to Arbitrary Code Execution.
High
CVE-2023-34233
Snowflake Python Connector vulnerable to Command Injection
Medium
CVE-2023-34239
Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
Medium
CVE-2023-32683
Synapse has URL deny list bypass via oEmbed and image URLs when generating previews
Medium
CVE-2023-32682
Synapse has improper checks for deactivated users during login
Low
ghsa-5cpq-8wj7-hf2v
Vulnerable OpenSSL included in cryptography wheels
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.