Advisory Catalog

awxkit has a path traversal vulnerability

Apache Airflow has a Path Traversal issue

Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type

Bugsink: DOS using large numbers of event tags

vantage6 node has an Improper Access Control issue

Vantage6: Set admin user and password from environment or configuration

Vantage6: 2FA can be circumvented with hacked email access

sanic-cors contains an improper regular expression in the try_match() function

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Strawberry GraphQL has a Circular Fragment Reference DOS

WebOb: Location header normalization during redirect leads to open redirect - again

Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands

malla: Stored XSS via Meshtastic node names in multiple frontend pages

daphne: WebSocket handshake header smuggling through autobahn splitlines() mishandling of non-standard line separators

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable body data. The content of the body field isn't appropriately sanitized when being rendered. Does requir

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions

Nanobot contains a server-side request forgery vulnerability in the web_fetch tool

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

rattler has an entry-point path traversal in noarch:python install (arbitrary file write)

Apache Airflow has no certificate validation on SMTP STARTTLS connections

Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout

Apache Airflow has an Authorization Bypass Through User-Controlled Key

Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Apache Airflow has a Missing Authorization issue

Apache Airflow has a Link Following issue

Apache Airflow: Incomplete redaction allowlist exposes secrets in Connection `extra`  to read-permitted users

hermes-agent has an Uncontrolled Resource Consumption issue

hermes-agent has an Injection issue

praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings

BoxLite has a Timeout Bypass Vulnerability

zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood

zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion

zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service

tuf has platform-dependent delegation path matching

OpenStack Neutron has an Incorrect Authorization issue

Shamefile has an arbitrary file read via shamefile.yaml in shame next

local-deep-research has an SSRF bypass in `safe_get`

compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

pypdf: Manipulated XMP metadata streams can exhaust RAM

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes