Affected: PyPI: picklescan

picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extension. Because the malicious pickle file inclusion is not considered as part of the scope of picklescan, the file would pass security checks and appear to be safe, when it could instead prove to be problematic…

Affected: PyPI: langchain-community

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper author…

Affected: ericmj decimal

Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.

Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an …

Affected: ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

Affected: ThemeRex Photolia

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

Affected: Keen IT Solutions Educavo

Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

Affected: AncoraThemes Qwery

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

Affected: designthemes LMS

Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

Affected: ThemeREX Jacqueline

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

Affected: Chimpstudio FoodBakery

Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.