Advisory Catalog

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing p

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses

NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()

GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol

NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read

NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

NLTK: Default ENFORCE=False Disables All pathsec Security Controls

NLTK: Stable FrameNet and NKJP readers parse outside-root XML

NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure

NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

Wagtail: Improper restriction handling on Page translation API endpoint

Wagtail: Improper permission handling when copying snippets

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

Wagtail: Identification of documents by SHA1 hash

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

django CMS: Stored XSS in edit-mode plugin exception rendering

Wagtail: Improper restriction handling on Pages admin API

django CMS: Structure endpoint bypasses page-view permission