Advisory Catalog

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths

RestrictedPython guard hooks can be shadowed via positional-only arguments

asyncssh has SCP Path Traversal to Arbitrary File Write

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restric

`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

pypdf: Possible infinite loop for not terminated inline images

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

vLLM denial of service via prompt embeds on M-RoPE models

vLLM has Remote DoS via Invalid Recovered Token Reinjection

Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command

Langroid: handle_message() executes user-supplied tool JSON without sender verification

Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`

flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf

Apache Airflow Google provider allows path traversal through GCS object names

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.  Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). Th

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling's check_safety() function returns LIKELY_SAFE with

NLTK Stanford wrapper classes execute untrusted JAR files without verification

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalation via /usr/bin/apt-get arguments

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Langroid: Path traversal in the file tools allows read/write outside configured current directory

MLflow: trace API endpoints lack proper authorization validators

Wagtail: Reflected XSS in dynamic image URL generator view

Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks

Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)

DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

Flawfinder output manipulation via untrusted filenames and source text

python-socketio: Binary attachment accumulation can cause denial of service

python-engineio has unbound thread allocation that can cause denial of service

python-engineio has possible denial of service due to maximum payload size sometimes not being enforced

Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)