Skip to content
OpenAdvisories

Archive

20 March 2025

Vulnerabilities first published on this day (UTC), newest first.

← February 2025 2025 / March /20 April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.5
    CVE-2025-2539 Public exploit Scanner template

    File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read

    The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use …

    Thom Stark File Away Web / CMS
  • Medium 6.5
    CVE-2025-0184 Public exploit

    Server-Side Request Forgery (SSRF) in langgenius/dify

    A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value i…

    langgenius langgenius/dify
  • High 7.5
    CVE-2024-12886 Public exploit

    Out-Of-Memory (OOM) Vulnerability in ollama/ollama

    An Out-Of-Memory (OOM) vulnerability exists in the `ollama` server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the `ollama` server crashing. The vulnerability is present i…

    Ollama ollama/ollama github.com/ollama/ollama Go
  • High 7.5
    CVE-2024-8859 Public exploit Scanner template

    Path Traversal in mlflow/mlflow

    A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the pat…

    MLflow mlflow/mlflow mlflow PyPI
  • High 7.5
    CVE-2024-10829 Public exploit

    Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpt

    A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to …

    eosphoros-ai eosphoros-ai/db-gpt dbgpt PyPI
  • High 7.5
    CVE-2024-10821 Public exploit

    Denial of Service (DoS) in invoke-ai/invokeai

    A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters a…

    invoke-ai invoke-ai/invokeai invokeai PyPI
  • Critical 9.1
    CVE-2024-11042 Public exploit

    Arbitrary File Delete in invoke-ai/invokeai

    In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive syst…

    invoke-ai invoke-ai/invokeai invokeai PyPI
  • Critical 9.8
    CVE-2024-12029 Public exploit

    Remote Code Execution via Model Deserialization in invoke-ai/invokeai

    A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can e…

    invoke-ai invoke-ai/invokeai invokeai PyPI
  • Medium 6.1
    CVE-2024-48591 Public exploit

    Inflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting (XSS). A specially crafted SVG file can be uploaded th…

  • Critical 9.8
    CVE-2024-48590 Public exploit

    Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService. This allows a…