Security advisories

high2025-03-20

CVE-2024-8953-Composio Eval Injection Vulnerability

composiohq/composio-js · GHSA-5xg7-5662-8x7j

high2025-03-20

CVE-2024-8966-Gradio DOS in multipart boundry while uploading the file

gradio-app/gradio · GHSA-5cpq-9538-jm2j

high2025-03-20

CVE-2024-8859-MLflow has a Local File Read/Path Traversal in dbfs

mlflow/mlflow · GHSA-4rqf-8pfm-p36r

medium2025-03-20

CVE-2024-8955-composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL

composiohq/composio · GHSA-38mg-wm59-g64x

high2025-03-20

CVE-2024-8501-AgentScope arbitrary file download vulnerability in rpc_agent_client

modelscope/agentscope · GHSA-p6h7-hfj2-vmcf

critical2025-03-20

CVE-2024-8551-AgentScope path traversal vulnerability in save-workflow

modelscope/agentscope · GHSA-j9rw-qm5f-r8xm

high2025-03-20

CVE-2024-8616-H2O Vulnerable to Arbitrary File Overwrite

h2oai/h2o-3 · GHSA-g48v-3p35-88jr

high2025-03-20

CVE-2024-8438-AgentScope Path Traversal in /api/file

modelscope/agentscope · GHSA-f4hc-q562-cc5r

critical2025-03-20

CVE-2024-8537-AgentScope path traversal vulnerability

modelscope/agentscope · GHSA-c4cc-w454-4634

critical2025-03-20

CVE-2024-8502-AgentScope Deserialization Vulnerability

modelscope/agentscope · GHSA-9w5h-67gf-xvv8

high2025-03-20

CVE-2024-8487-AgentScope Cross-Origin Resource Sharing (CORS) vulnerability

modelscope/agentscope · GHSA-75v5-6885-59f9

high2025-03-20

CVE-2024-8524-AgentScope directory traversal vulnerability in /read-examples

modelscope/agentscope · GHSA-6v28-q95m-93qr

medium2025-03-20

CVE-2024-8556-AgentScope stored cross-site scripting (XSS) vulnerability

modelscope/agentscope · GHSA-6mf6-7j75-2m6f

critical2025-03-20

CVE-2024-8769-Aim path traversal in LockManager.release_locks

aimhubio/aim · GHSA-4qcx-jx49-6qrh

medium2025-03-20

CVE-2024-8238-Aim Improper Access Control

aimhubio/aim · GHSA-r229-5wgf-f28g

high2025-03-20

CVE-2024-7990-Open WebUI stored cross-site scripting (XSS) vulnerability

open-webui/open-webui · GHSA-gj27-76gq-5v3p

high2025-03-20

CVE-2024-8060-Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

open-webui/open-webui · GHSA-ff5c-56m7-vc75

high2025-03-20

CVE-2024-8053-Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint

open-webui/open-webui · GHSA-9vf8-xgwm-97r8

high2025-03-20

CVE-2024-8020-PyTorch Lightning denial of service vulnerability

lightning-ai/pytorch-lightning · GHSA-98fp-7v67-4v3q

medium2025-03-20

CVE-2024-8021-Gradio Vulnerable to Open Redirect

gradio-app/gradio · GHSA-7v2w-h4gh-w5cv