Ressource Efficient Computer Vision

Certifi removes GLOBALTRUST root certificate

sqlparse: formatting list of tuples leads to denial of service

HuggingFace transformers vulnerable to remote code execution

Werkzeug safe_join() allows Windows special device names

Starlette has possible denial-of-service vector when parsing large files in multipart forms

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

urllib3 streaming API improperly handles highly compressed data

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

PyTorch susceptible to local Denial of Service

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

Flask-CORS vulnerable to Improper Handling of Case Sensitivity

MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint

urllib3 does not control redirects in browsers and Node.js

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

mlflow Creates of Temporary File in Directory with Insecure Permissions

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Vulnerable OpenSSL included in cryptography wheels

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

MLflow: Deterministic sampling in dataset digest enables predictable collisions

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Python-Markdown has an Uncaught Exception

Pillow has a heap buffer overflow with nested list coordinates

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

pyasn1 has a DoS vulnerability in decoder

MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

Flask session does not add `Vary: Cookie` header when accessed in some ways

HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

pytest has vulnerable tmpdir handling

GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

MLflow: unauthenticated access to certain FastAPI routes

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

Tornado has incomplete validation of cookie attributes

Vulnerable OpenSSL included in cryptography wheels

Tornado vulnerable to excessive logging caused by malformed multipart form data

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

protobuf affected by a JSON recursion depth bypass

Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)

mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

Flask-CORS improper regex path matching vulnerability

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

flask-cors vulnerable to log injection when the log level is set to debug