Advisory Catalog

PraisonAI has Template Injection in Agent Tool Definitions

PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server

NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows

rfc3161-client Has Improper Certificate Validation

LiteLLM: Password hash exposure and pass-the-hash authentication bypass

Emmett has a path traversal in internal assets handler

MONAI: Unsafe functions lead to pickle deserialization rce

FastFeedParser has an infinite redirect loop DoS via meta-refresh chain

Django vulnerable to ASGI header spoofing via underscore/hyphen conflation

Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit

HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

PraisonAI recipe registry publish path traversal allows out-of-root file write

PraisonAI recipe registry pull path traversal writes files outside the chosen output directory

PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction

strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions

strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol

OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write

OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)

pyLoad: Improper Neutralization of Special Elements used in an OS Command

LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass

pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter

BentoML: Command Injection in cloud deployment setup script

LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service

curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)

Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims

Ajenti has an authorization bypass during custom package installation

Kedro: Path Traversal in versioned dataset loading via unsanitized version string

vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models

ONNX: TOCTOU arbitrary file read/write in save_external_dat

PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL

PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback

PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()

Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write

OpenEXR: integer overflow to OOB write in uncompress_b44_impl()

OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)

openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers

openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers

openssl-encrypt has no owner verification on key revocation — any client can revoke any key

ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the

ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.

Open WebUI has Broken Access Control in Tool Valves

Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection

openssl-encrypt has visible password in process list via --password CLI argument

onnx Vulnerable to Path Traversal via Symlink

FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

FastMCP has a Command Injection vulnerability - Gemini CLI