{"kind": "product", "path": "vulns/pypi/aim", "name": "aim", "product": "aim", "ecosystem": "PyPI", "items": [{"id": "CVE-2025-51464", "noindex": false, "published": "2025-07-22T00:00:00.000Z", "modified": "2025-07-22T18:18:12.170Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00706, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-51464", "title": "CVE-2025-51464", "description": "Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().", "references": ["https://github.com/aimhubio/aim", "https://github.com/aimhubio/aim/pull/3333", "https://www.gecko.security/blog/cve-2025-51464"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-5321", "noindex": false, "published": "2025-05-29T15:00:06.375Z", "modified": "2025-06-01T04:39:53.266Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00647, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-5321", "title": "aimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalation", "description": "A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage leads to erweiterte Rechte. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "references": ["https://vuldb.com/?id.310492", "https://vuldb.com/?ctiid.310492", "https://vuldb.com/?submit.580253"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-8769", "noindex": false, "published": "2025-03-20T10:11:22.123Z", "modified": "2025-10-15T12:50:42.461Z", "cvss": 9.1, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "severity": "critical", "epss": 0.00927, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-8769", "title": "Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim", "description": "A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The `run_hash` parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability is exposed through the `Repo._close_run()` method, which is accessible via the tracking server instruction API. As a result, an attacker can exploit this to delete any arbitrary file on the machine running the tracking server.", "references": ["https://huntr.com/bounties/59d3472f-f581-4beb-a090-afd36a00ecf7", "https://nvd.nist.gov/vuln/detail/CVE-2024-8769"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-12777", "noindex": false, "published": "2025-03-20T10:11:15.212Z", "modified": "2025-03-20T13:30:19.041Z", "cvss": 5.9, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00483, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-12777", "title": "Denial of Service in aimhubio/aim", "description": "A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking server, which is single-threaded, can be made unresponsive by requesting it to connect to an unresponsive socket via sshfs. The lack of an additional timeout setting in the sshfs-client causes the server to hang for a significant amount of time, preventing it from responding to other requests.", "references": ["https://huntr.com/bounties/cdf8db79-c290-4fe5-9383-4c518bfba4a8", "https://nvd.nist.gov/vuln/detail/CVE-2024-12777"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-8238", "noindex": false, "published": "2025-03-20T10:11:09.622Z", "modified": "2025-10-15T12:49:56.303Z", "cvss": 5.9, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00774, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-8238", "title": "Unrestricted Code Execution in aimhubio/aim", "description": "In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safer_getattr() function from RestrictedPython. This version does not protect against the str.format_map() method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution. The vulnerability arises because str.format_map() can read arbitrary attributes of Python objects, enabling attackers to access sensitive variables such as os.environ. If an attacker can write files to a known location on the Aim server, they can use str.format_map() to load a malicious .dll/.so file into the Python interpreter, leading to unr", "references": ["https://huntr.com/bounties/4e140ef9-f6d1-4e68-a44c-3b9e856924d3", "https://nvd.nist.gov/vuln/detail/CVE-2024-8238"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-0189", "noindex": false, "published": "2025-03-20T10:10:54.858Z", "modified": "2025-10-15T12:50:04.149Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00644, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-0189", "title": "Denial of Service in aimhubio/aim", "description": "In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large image, leading to a denial of service condition.", "references": ["https://huntr.com/bounties/e4c9bf41-72cf-4d04-baaf-8f12b5b7926e", "https://nvd.nist.gov/vuln/detail/CVE-2025-0189"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-6829", "noindex": false, "published": "2025-03-20T10:10:50.251Z", "modified": "2025-03-20T18:15:48.518Z", "cvss": 9.1, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "severity": "critical", "epss": 0.00884, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-6829", "title": "Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim", "description": "A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control `repo.path` and `run_hash` to bypass directory existence checks and extract files to unintended locations, potentially overwriting critical files. This can lead to arbitrary data being written to arbitrary locations on the remote tracking server, which could be used for further attacks such as writing a new SSH key to the target server.", "references": ["https://huntr.com/bounties/7c97065c-1b63-4982-82c1-8038be0ed570", "https://nvd.nist.gov/vuln/detail/CVE-2024-6829"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-12778", "noindex": false, "published": "2025-03-20T10:10:10.394Z", "modified": "2025-10-15T12:49:31.683Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00794, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-12778", "title": "Denial of Service in aimhubio/aim", "description": "A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service (DoS) attack. The issue arises when a large number of tracked metrics are retrieved simultaneously from the Aim web API, causing the web server to become unresponsive. The root cause is the lack of a limit on the number of metrics that can be requested per call, combined with the server's single-threaded nature, leading to excessive resource consumption and blocking of the server.", "references": ["https://huntr.com/bounties/892a9eee-0251-4e57-94a4-dad2e7f32715", "https://nvd.nist.gov/vuln/detail/CVE-2024-12778"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-8061", "noindex": false, "published": "2025-03-20T10:10:09.524Z", "modified": "2025-10-15T12:49:55.677Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00482, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-8061", "title": "Denial of Service in aimhubio/aim", "description": "In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts.", "references": ["https://huntr.com/bounties/c85d005c-b354-4c51-a88f-adda2f09622b", "https://nvd.nist.gov/vuln/detail/CVE-2024-8061"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-6851", "noindex": false, "published": "2025-03-20T10:09:55.149Z", "modified": "2025-03-20T18:32:59.392Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0107, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-6851", "title": "Arbitrary File Deletion in aimhubio/aim", "description": "In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted glob-pattern to lead to arbitrary file deletion.", "references": ["https://huntr.com/bounties/839703fb-23b7-4dc4-ae81-44cd4740d3f3", "https://nvd.nist.gov/vuln/detail/CVE-2024-6851"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-6483", "noindex": false, "published": "2025-03-20T10:09:36.384Z", "modified": "2025-03-20T18:37:01.937Z", "cvss": 5.3, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00889, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-6483", "title": "Arbitrary File/Directory Deletion in aimhubio/aim", "description": "A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion. This can be exploited to delete arbitrary files or directories, potentially causing denial of service or data loss.", "references": ["https://huntr.com/bounties/dc45d480-e579-4af4-8603-c52ecfd5e363", "https://nvd.nist.gov/vuln/detail/CVE-2024-6483"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-10110", "noindex": false, "published": "2025-03-20T10:09:22.842Z", "modified": "2025-03-20T18:55:48.687Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00642, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-10110", "title": "Denial of Service in aimhubio/aim", "description": "In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the tracking server becomes unable to respond to other requests.", "references": ["https://huntr.com/bounties/5ea6cf56-7b4c-4dce-9b6c-3e910fbb1ae4", "https://nvd.nist.gov/vuln/detail/CVE-2024-10110"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-7760", "noindex": false, "published": "2025-03-20T10:09:04.131Z", "modified": "2025-03-20T18:58:57.731Z", "cvss": 7.4, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00522, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-7760", "title": "CSRF in aimhubio/aim", "description": "aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can be chained with other existing vulnerabilities such as remote code execution, denial of service, and arbitrary file read/write.", "references": ["https://huntr.com/bounties/2038df5f-4829-4040-8573-67bf9bb89229", "https://nvd.nist.gov/vuln/detail/CVE-2024-7760"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-0190", "noindex": false, "published": "2025-03-20T10:08:48.087Z", "modified": "2025-03-20T19:03:20.216Z", "cvss": 7.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00639, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-0190", "title": "Denial of Service in aimhubio/aim", "description": "In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.", "references": ["https://huntr.com/bounties/38d151f1-abb4-443a-86b0-6c26f0c6cb70", "https://nvd.nist.gov/vuln/detail/CVE-2025-0190"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-8863", "noindex": false, "published": "2024-09-14T23:00:05.339Z", "modified": "2024-09-16T14:13:21.333Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00503, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-8863", "title": "aimhubio aim Text Explorer textbox.tsx dangerouslySetInnerHTML cross site scripting", "description": "A vulnerability, which was classified as problematic, was found in aimhubio aim up to 3.24. Affected is the function dangerouslySetInnerHTML of the file textbox.tsx of the component Text Explorer. The manipulation of the argument query leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "references": ["https://vuldb.com/?id.277500", "https://vuldb.com/?ctiid.277500", "https://vuldb.com/?submit.403203"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-6578", "noindex": false, "published": "2024-07-29T18:37:16.820Z", "modified": "2024-08-01T21:41:03.725Z", "cvss": 7.2, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "severity": "high", "epss": 0.00285, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-6578", "title": "Stored XSS in aimhubio/aim", "description": "A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.", "references": ["https://huntr.com/bounties/5b1ebc67-5346-44aa-b8b8-3c1c09d79680", "https://nvd.nist.gov/vuln/detail/CVE-2024-6578"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-6227", "noindex": false, "published": "2024-07-08T19:06:31.579Z", "modified": "2024-08-30T15:25:02.656Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00577, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-6227", "title": "Infinite Loop in aimhubio/aim", "description": "A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to cause an infinite loop by configuring the remote tracking server to point at itself. This results in the server endlessly connecting to itself, rendering it unable to respond to other connections.", "references": ["https://huntr.com/bounties/abcea7c6-bb3b-45e9-aa15-9eb6b224451a", "https://nvd.nist.gov/vuln/detail/CVE-2024-6227"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-2195", "noindex": false, "published": "2024-04-10T17:08:12.635Z", "modified": "2024-08-01T19:03:39.092Z", "cvss": 9.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.01815, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-2195", "title": "Remote Code Execution in aimhubio/aim", "description": "A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions >= 3.0.0. The vulnerability resides in the `run_search_api` function of the `aim/web/api/runs/views.py` file, where improper restriction of user access to the `RunView` object allows for the execution of arbitrary code via the `query` parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.", "references": ["https://huntr.com/bounties/22f2355e-b875-4c01-b454-327e5951c018", "https://nvd.nist.gov/vuln/detail/CVE-2024-2195"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-2196", "noindex": false, "published": "2024-04-10T17:08:12.021Z", "modified": "2024-08-01T19:03:39.185Z", "cvss": 8.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00587, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-2196", "title": "CSRF Vulnerability in aimhubio/aim", "description": "aimhubio/aim is vulnerable to Cross-Site Request Forgery (CSRF), allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboard. An attacker can exploit this by tricking a user into executing a malicious script that sends unauthorized requests to the aim server, leading to potential data loss and unauthorized data manipulation.", "references": ["https://huntr.com/bounties/e141e3f2-afbb-405f-a891-f66628c8b68f", "https://nvd.nist.gov/vuln/detail/CVE-2024-2196"], "fixes": [], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}, {"id": "CVE-2021-43775", "noindex": false, "published": "2021-11-23T19:15:13.000Z", "modified": "2024-08-04T04:03:08.638Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.01907, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2021-43775", "title": "Arbitrary file reading vulnerability in Aim", "description": "Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. The vulnerability issue is resolved in Aim v3.1.0.", "references": ["https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjcc", "https://github.com/aimhubio/aim/issues/999", "https://github.com/aimhubio/aim/pull/1003"], "fixes": ["3.1.0"], "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}, {"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}]}], "total": 20, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "aim", "path": "vulns/pypi/aim", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2025-10-15T12:50:42.461Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}