Advisory Catalog

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Vibe-Trading file-read tools expose arbitrary server-readable files

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

LangGraph SDK custom auth silently ignores actions= on resource decorators

Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

uv: Path traversal on Windows through wheel extraction

Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

pypdf: Possible large memory usage when retrieving alphabetical page labels

pypdf: Possible long runtimes with large amount of embedded files

pypdf: Possible long runtimes when generating appearance streams

pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

pypdf: Possible large memory usage when parsing font data

pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

pypdf: Possible long runtimes/large memory usage when parsing indirect objects

pypdf: Possible large memory usage when retrieving Roman page labels

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been p

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

urllib3: Chunked Deflate streaming can enter an infinite loop

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

Werkzeug safe_join() allows Windows special device names