Medium
CVE-2024-24773
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Medium
CVE-2024-24772
Apache Superset: Improper Neutralization of custom SQL on embedded context
Medium
CVE-2024-27315
Apache Superset: Improper error handling on alerts
Medium
CVE-2024-25711
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of
Medium
CVE-2024-24564
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte a
Medium
CVE-2024-26149
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read posi
Low
ghsa-p4m5-32pr-2hqr
PyPop C extensions possible vulnerability: missing arguments and redundant null pointers
Critical
CVE-2024-27444
LangChain Experimental vulnerable to arbitrary code execution
Medium
CVE-2024-27447
pretix before 2024.1.1 mishandles file validation.
Low
CVE-2024-0243
langchain Server-Side Request Forgery vulnerability
High
CVE-2024-27454
orjson does not limit recursion for deeply nested JSON documents
High
CVE-2024-21502
Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used and interpreted as use
Critical
CVE-2024-27133
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerabil
Critical
CVE-2024-27132
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.
High
CVE-2024-27318
Onnx Directory Traversal vulnerability
Medium
CVE-2024-27319
Onnx Out-of-bounds Read vulnerability
Medium
CVE-2024-26152
Summary
High
ghsa-rc4p-p3j9-6577
pypqc private key retrieval vulnerability
High
CVE-2024-26130
cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
Critical
CVE-2024-23346
pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string
High
CVE-2024-26134
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a
Critical
CVE-2024-25141
Improper Certificate Validation in apache airflow mongo hook
High
CVE-2024-1647
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain
Low
ghsa-77hh-43cm-v8j6
tuf's Metadata API: Targets.get_delegated_role() is missing input validation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.