Advisory Catalog

sanic chunked trailer request smuggling allows hidden second request execution

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

djust has broken object-level access control (IDOR)

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

djust has an authorization bypass on the WebSocket/SSE mount path

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

LiteLLM Proxy has server-side request forgery via the `user_config` request parameter

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Ka

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces