Advisory Catalog

PraisonAI: SpiderTools redirect-target SSRF protection bypass

PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

BBOT: Arbitrary File Write in postman_download Module

BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284

marimo contains a reflected cross-site scripting vulnerability in the notebook page

joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

OpenStack Horizon RC file generation does not escape special characters in project names

Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}

Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar

vLLM: OOM Denial of Service via Audio Decompression Bomb

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read

Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes

Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning

pypdf: Possible infinite loop when processing outlines/bookmarks in writer

pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

pypdf: Possible large memory usage for form XObjects during text extraction

pypdf: Inefficient decoding of FlateDecode PNG predictor streams

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

aiohttp: Incomplete websocket frame payloads bypass memory limits

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

Tornado has out-of-bounds memory access via C extension

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections,

Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

PDM: Project-Local State and Config Writes Follow Symlinks

Weblate SSRF: outbound URL guard misses some private ranges

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors