漏洞公告

Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot

Duplicate Advisory: Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel

Duplicate Advisory: motionEye vulnerable to RCE via unsanitized motion config parameter

Duplicate Advisory: SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

Duplicate Advisory: Open Babel has out-of-bounds read in PQS lowerit (pre-buffer read)

Duplicate Advisory: Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

Duplicate Advisory: Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines

Duplicate Advisory: Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles

Duplicate Advisory: Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies

Duplicate Advisory: Open Babel has out-of-bounds write (overlapping memcpy) in zipstream basic_unzip_streambuf::underflow

Duplicate Advisory: Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule

Duplicate Advisory: Malicious versions of Nx were published

Duplicate Advisory: rollbar vulnerable to prototype pollution

Withdrawn Advisory: fast-redact vulnerable to prototype pollution

Duplicate Advisory: The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.

Duplicate Advisory: Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports

Duplicate Advisory: Picklescan Bypass is Possible via File Extension Mismatch

Duplicate Advisory: Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check

Duplicate Advisory: express-xss-sanitizer has an unbounded recursion depth

Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks

Malicious versions of Nx were published

Duplicate Advisory: Keycloak Potential Variable Reference in Model Storage Services

Withdrawn Advisory: Microsoft Knack ReDoS Vulnerability in the Introspection Module