Critical
CVE-2024-36264
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,359
Reset filters
Critical
CVE-2024-4315
parisneo/lollms Local File Inclusion (LFI) attack
Medium
CVE-2024-35225
Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.
Medium
CVE-2024-58384
Tornado has a CRLF injection in CurlAsyncHTTPClient headers
Medium
CVE-2024-14029
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado
High
CVE-2024-4881
A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper
Medium
CVE-2024-2965
Denial of service in langchain-community
High
CVE-2024-2928
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure t
Medium
CVE-2024-2383
A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. T
High
CVE-2024-0520
A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.h
Medium
CVE-2024-5206
scikit-learn sensitive data leakage vulnerability
High
CVE-2024-3408
Authentication bypass in dtale
Critical
CVE-2024-5452
Remote code execution in pytorch lightning
High
CVE-2024-4941
A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the `postprocess()` function within `gra
High
CVE-2024-35178
Jupyter server on Windows discloses Windows user password hash
High
ghsa-hvh4-5qr6-3v7r
Observable Timing Discrepancy in pypqc
Low
ghsa-4m3g-6r7g-jv4f
Arbitrary JavaScript execution due to using outdated libraries
High
CVE-2024-37058
MLFlow unsafe deserialization
Critical
CVE-2024-3829
qdrant input validation failure
Medium
CVE-2024-36112
Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI
Critical
CVE-2024-35374
Mocodo vulnerable to SQL injection in `/web/generate.php`
High
CVE-2024-26139
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack of certain security controls on the profile edit functionalit
Critical
CVE-2024-5023
ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command
High
CVE-2024-4181
RunGptLLM class in LlamaIndex has a command injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.