Security advisories

critical2025-03-20

CVE-2024-11042-InvokeAI Arbitrary File Deletion vulnerability

invoke-ai/invokeai · GHSA-227r-w5j2-6243

critical2025-03-20

CVE-2024-10835-DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users

eosphoros-ai/db-gpt · GHSA-qccg-9m4q-xfm6

critical2025-03-20

CVE-2024-10833-DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload

eosphoros-ai/db-gpt · GHSA-j9g7-mqhh-9hxf

critical2025-03-20

CVE-2024-10831-DB-GPT Absolute Path Traversal vulnerability

eosphoros-ai/db-gpt · GHSA-hhw5-29f6-hf4x

high2025-03-20

CVE-2024-10713-HyperLPR Denial of Service vulnerability

szad670401/hyperlpr · GHSA-cg4p-5qfm-pjjj

high2025-03-20

CVE-2024-10830-DB-GPT Path Traversal vulnerability

eosphoros-ai/db-gpt · GHSA-8pwp-phcg-h36g

critical2025-03-20

CVE-2024-10901-DB-GPT Arbitrary File Write vulnerability

eosphoros-ai/db-gpt · GHSA-7gj6-22m4-qfhx

high2025-03-20

CVE-2024-10829-DB-GPT Uncontrolled Resource Consumption vulnerability

eosphoros-ai/db-gpt · GHSA-6xgj-c5fx-5v57

high2025-03-20

CVE-2024-10821-InvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`

invoke-ai/invokeai · GHSA-6f6x-f56q-5xgv

critical2025-03-20

CVE-2024-10902-DB-GPT vulnerable to Arbitrary File Upload with Path Traversal

eosphoros-ai/db-gpt · GHSA-3xq5-x4fj-rff7

high2025-03-20

CVE-2024-10906-DB-GPT vulnerable to Cross-Site Request Forgery

eosphoros-ai/db-gpt · GHSA-3248-f932-c76p

high2025-03-20

CVE-2024-10549-H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint

h2oai/h2o-3 · GHSA-wwr9-4gmr-xvq9

high2025-03-20

CVE-2024-10572-H2O Vulnerable to Denial of Service (DoS) and File Write

h2oai/h2o-3 · GHSA-wjpv-64v2-2qpq

high2025-03-20

CVE-2024-10624-Gradio Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

gradio-app/gradio · GHSA-rvgh-pr46-x7gg

high2025-03-20

CVE-2024-10648-Gradio Vulnerable to Arbitrary File Deletion

gradio-app/gradio · GHSA-pgfv-gvc5-prfg

critical2025-03-20

CVE-2024-10553-H2O Deserialization of Untrusted Data Vulnerability

h2oai/h2o-3 · GHSA-h7xg-cmpp-48hf

high2025-03-20

CVE-2024-10569-Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb

gradio-app/gradio · GHSA-7xmc-vhjp-qv5q

high2025-03-20

CVE-2024-10550-H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint

h2oai/h2o-3 · GHSA-7qq7-pvm9-x8rf

critical2025-03-20

CVE-2024-10190-Horovod Vulnerable to Command Injection

horovod/horovod · GHSA-mrhh-3ggq-23p2

high2025-03-20

CVE-2024-10188-LiteLLM Vulnerable to Denial of Service (DoS)

berriai/litellm · GHSA-gw2q-qw9j-rgv7