1 known vulnerability, worst severity CRITICAL.
how bad it is if exploited, out of 10
chance of exploitation in the next 30 days
CyberXYZ composite, and a working exploit is published
fig. 01 — GHSA-xm6r-4466-mr74, the advisory selected below
OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.
Checked 2026-09-22 at 02:56 UTC. The most recent advisory here was published 2018-10-18. Updated continuously from NVD, GHSA, OSV and CNA feeds.