Advisory Catalog

GitPython has Command Injection via Git options bypass

LiteLLM: Authenticated command execution via MCP stdio test endpoints

Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization

LiteLLM: Server-Side Template Injection in /prompts/test endpoint

InstructLab Includes Functionality from Untrusted Control Sphere

InstructLab vulnerable to Path Traversal

lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

Glances has SSRF in IP Plugin via public_api leading to credential leakage

Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions

Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false

Apache Airflow allows code execution through crafted XCom payloads

pretalx vulnerable to stored cross-site scripting in organizer search typeahead

Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

Mako: Path traversal via double-slash URI prefix in TemplateLookup

Apache Airflow: JWT token appearing in logs

wger has Broken Access Control in Global Gym Configuration Update Endpoint

Weblate: Privilege escalation in the user API endpoint

Weblate: Arbitrary File Read via Symlink

Weblate: Remote code execution during backup restoration

Apache Airflow: RCE by race condition in example_xcom dag

pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean

gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall

FITS GZIP decompression bomb in Pillow

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API

Keras has an untrusted deserialization vulnerability

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

uv vulnerable to arbitrary file deletion through RECORD entries

PraisonAI Vulnerable to RCE via Automatic tools.py Import

PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries

PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint

PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution

Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble

PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback

PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure

PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading

LiteLLM has a sandbox escape in custom-code guardrail

PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool

PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool

PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls

PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate

PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits

PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS

PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform proces

AGiXT Vulnerable to Path Traversal in safe_join()

PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling