Retrieval Evaluation

Certifi removes GLOBALTRUST root certificate

HuggingFace transformers vulnerable to remote code execution

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

AIOHTTP has CRLF injection through multipart part content type header construction

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

urllib3 streaming API improperly handles highly compressed data

PyTorch susceptible to local Denial of Service

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

Marshmallow has DoS in Schema.load(many)

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

urllib3 does not control redirects in browsers and Node.js

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

AIOHTTP vulnerable to brute-force leak of internal static file path components

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Python-Markdown has an Uncaught Exception

Pillow has a heap buffer overflow with nested list coordinates

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

pyasn1 has a DoS vulnerability in decoder

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

NLTK has a Path Traversal issue

AIOHTTP's unicode processing of header values could cause parsing discrepancies

HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

AIOHTTP vulnerable to denial of service through large payloads

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

protobuf affected by a JSON recursion depth bypass

NLTK has a Zip Slip Vulnerability

Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

PyTorch Improper Resource Shutdown or Release vulnerability

protobuf-python has a potential Denial of Service issue

Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

Requests vulnerable to .netrc credentials leak via malicious URLs

Requests `Session` object does not verify requests after making first request with verify=False

aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

AIOHTTP accepts duplicate Host headers

PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument