A flaw was found in containerd package. Containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This issue could ca…

▾ TwilightRed Hat · Red Hat Openshift Data Foundation 4.22EPSS 0.30%via CSAF

GHSA-v432-7f47-9g94High

1y ago

PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash

▾ Twilightpostquantum-feldman-vss · postquantum-feldman-vssvia OSV

CVE-2025-29787High

1y ago

Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write

▾ Twilightzip · zipEPSS 0.58%via OSV

Tagged “osv”

DB-GPT Uncontrolled Resource Consumption vulnerability

Aim allows denial of service due to no timeouts for some tracking server endpoints

H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

AgentScope stored cross-site scripting (XSS) vulnerability

InvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`

Composio Eval Injection Vulnerability

Open WebUI denial of service through endpoint for converting markdown

Gradio DOS in multipart boundry while uploading the file

langchain-core allows unauthorized users to read arbitrary files from the host file system

H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request

LiteLLM Vulnerable to Remote Code Execution (RCE)

Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

MLflow has a Local File Read/Path Traversal in dbfs

MLflow Uncontrolled Resource Consumption vulnerability

H2O Vulnerable to Arbitrary File Overwrite via File Export

Flask-CORS vulnerable to Improper Handling of Case Sensitivity

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Aim vulnerable to Cross-Site Request Forgery

composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL

Aim Uncontrolled Resource Consumption vulnerability

SageMaker Workflow component allows possibility of MD5 hash collisions

DB-GPT vulnerable to Cross-Site Request Forgery

vLLM Allows Remote Code Execution via Mooncake Integration

vLLM denial of service via outlines unbounded cache on disk

Apache Airflow MySQL Provider is Vulnerable to SQL Injection

containerd: containerd has an integer overflow in User ID handling (CVE-2024-40635)

PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash

Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write