Advisory Catalog

Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission

Mistune: Potential DoS via quadratic-time parsing in parse_link_text

motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

OctoPrint has possible file exfiltration via query parameters on upload endpoints

Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration

OpenHarness remote resume commands expose other users' saved session snapshots

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the p

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution

Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py

Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path

Anki's local HTTP server does not sufficiently validate requests

LangSmith SDK TracingMiddleware: Arbitrary server-side file read

EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id

stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)

stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)

stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

Langflow: Unauthenticated DoS through multipart form boundary file upload

Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size

VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files

Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser

Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit

Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN

py7zr: Arbitrary File Write Vulnerability

mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

Crawl4AI: Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)

Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml

PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal

praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS

PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API

PraisonAI: Compute-bridged file tools allow shell command injection