Incidents tagged vulnerability

Evidence indicates that Custom Code Guardrails is affected by remote code execution.

Evidence indicates that LightGlue is affected by remote code execution. Exploitation evidence is classified as demonstrated.

Evidence indicates that transformers is affected by a security issue. Reported affected versions include 5.3.0.

### Impact The `/config/update endpoint` does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following: - Modify proxy configuration and environment variables - Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution - Read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image - Take over other priveleged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables ### Patches Fixed in v1.83.0. The endpoint now requires `proxy_admin` role. ### Workarounds Restrict API key distribution. There is no configuration-level workaround.

Evidence indicates that PyTorch is affected by a security issue.

Evidence indicates that Meta is affected by remote code execution.

Evidence indicates that MCP is affected by a security issue. Exploitation evidence is classified as demonstrated.

Evidence indicates that SQLite is affected by a security issue. Reported affected versions include 3.50.2.

Evidence indicates that litellm is affected by a security issue. Reported affected versions include 1.40.12.

Evidence indicates that langchain is affected by information disclosure.

Evidence indicates that transformers library is affected by remote code execution.

Evidence indicates that LangChain is affected by remote code execution.

Evidence indicates that Langchain is affected by remote code execution.

Evidence indicates that Langchain is affected by remote code execution. Reported affected versions include 0.0.171.