Vulnerabilities
Summary — last 7 days
New vulnerabilities5,169▲ 2,076 vs. last week
Critical / high2,875▲ 1,375 vs. last week
New active exploitation (KEV)9▲ 4 vs. last week
Unscored (no CVSS)184▼ 23 vs. last week
28 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (9.8) | 0.96% | — | Llamaindex Llama IndexAI | 4/10/2024 | 6/17/2026 | A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and… | |
| Modified | Critical (9.8) | 0.66% | — | Llamaindex | 1/22/2024 | 6/17/2026 | LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Drop the Students… | |
| Modified | Critical (9.8) | 1.5% | — | Llamaindex Project Llamaindex | 8/15/2023 | 6/17/2026 | An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function. |