Critical
CVE-2023-7152
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Medium
CVE-2023-6681
A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. Th
Medium
CVE-2023-49438
An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on t
High
CVE-2023-50731
GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182
High
CVE-2023-51449
Gradio makes the `/file` secure against file traversal and server-side request forgery attacks
Low
CVE-2023-51649
Nautobot missing object-level permissions enforcement when running Job Buttons
Medium
CVE-2023-50783
Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.
Medium
CVE-2023-49920
Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website
Medium
CVE-2023-47265
Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. Thi
Medium
CVE-2023-48291
Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write acce
High
CVE-2023-7018
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
High
CVE-2023-6976
MLflow Path Traversal Vulnerability
High
CVE-2023-6977
MLflow Local File Disclosure Vulnerability
Critical
CVE-2023-6974
MLflow Server-Side Request Forgery (SSRF)
Critical
CVE-2023-6975
MLFlow Path Traversal Vulnerability
High
CVE-2023-6909
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
High
ghsa-9wgg-m99q-hhfc
Expired tokens can be renewed without validating the account password
High
CVE-2023-6730
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Medium
CVE-2023-46104
Apache Superset uncontrolled resource consumption
High
CVE-2023-49734
Apache Superset incorrect write permissions vulnerability
Medium
CVE-2023-49736
Apache Superset SQL injection vulnerability
High
CVE-2023-6940
mlflow Command Injection vulnerability
Medium
ghsa-4h72-34j6-j8x7
Maloja error page XSS vulnerability
Medium
ghsa-hfmc-7525-mj55
AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.