Advisory Catalog

LlamaIndex Vulnerable to Denial of Service (DoS)

OpenStack Ironic fails to restrict paths used for file:// image URLs

Django has a denial-of-service possibility in strip_tags()

Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration

FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. An HTTP header injection vulnerability has been identified in versions prior to 2.0.0. By manipulating the X-Forwarded-For header, an attacker can potentially injec

Langroid Allows XXE Injection via XMLToolMessage

Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack

Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

Open WebUI allows limited stored XSS vila uploaded html file

Mezzanine CMS Cross-Site Scripting (XSS) vulnerability

OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the mal

Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL

OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the `external` flag on/off and change

vLLM: Quadratic Time Complexity in Input Token Processing​ leads to denial of service

vLLM Vulnerable to Remote Code Execution via Mooncake Integration

Data exposure via ZeroMQ on multi-node vLLM deployment

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

AWorld OS Command Injection vulnerability