漏洞公告

UltraJSON has a Memory Leak in ujson.dump() on Write Failure

SillyTavern has a SSRF vulnerability in the CORS proxy middleware

SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware

SillyTavern has a Path Traversal issue

SillyTavern has Authentication Bypass via SSO Header Injection

SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files

esm.sh: Legacy Route Path Traversal Can Lead to RCE

HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack

HashiCorp Nomad vulnerable to a path traversal

HashiCorp Nomad vulnerable to symlink attack

Security feature bypass vulnerability in Azure Key Vault Keys library for Java

Ludwig framework is vulnerable to insecure deserialization in its model serving component

Ludwig framework is vulnerable to insecure deserialization through its predict() method.

mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

mem0 server lacks authentication and authorization controls for its memory management API endpoints

mem0 server lacks authentication and authorization controls for its memory deletion API endpoint

imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module

llm CLI tool contains a code injection vulnerability via `--functions` command-line argument

mem0 server lacks authentication and authorization controls for its memory creation API endpoint

Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism

Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component

Apache Tomcat - HTTP/2 request headers not validated