Critical
CVE-2025-29783
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 456
Reset filters
Medium
CVE-2024-24778
Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know.
Critical
CVE-2024-49375
Rasa Allows Remote Code Execution via Remote Model Loading
Critical
CVE-2024-49768
Waitress has request processing race condition in HTTP pipelining with invalid first request
High
CVE-2024-31411
Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes.
Medium
CVE-2024-31979
Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements.
Low
CVE-2024-30471
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration.
Critical
ghsa-q5fm-55c2-v6j9
Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib
Low
ghsa-p4m5-32pr-2hqr
PyPop C extensions possible vulnerability: missing arguments and redundant null pointers
Critical
CVE-2024-23752
Code execution in pandasai
Medium
ghsa-hfmc-7525-mj55
AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC
Medium
CVE-2023-46137
twisted.web has disordered HTTP pipeline response
Medium
CVE-2023-5752
Command Injection in pip when used with Mercurial
Medium
CVE-2023-41885
Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration
Medium
CVE-2023-37276
aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser
Critical
CVE-2023-31543
A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.
Medium
CVE-2023-28858
redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send
High
CVE-2023-28859
redis-py through 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an
Medium
ghsa-8r99-h8j2-rw64
Twisted vulnerable to HTTP Request Smuggling Attacks
Medium
CVE-2020-7658
meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header par
Critical
CVE-2014-4966
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code v
High
CVE-2015-5271
The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline wh
Medium
CVE-2014-8991
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
High
CVE-2022-21668
Pipenv's requirements.txt parsing allows malicious index url in comments
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.