Advisory Catalog

OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication

askbot inexhaustive permissions check allows any user to modify a different user's profile picture

pypdf has possible Infinite Loop when processing outlines/bookmarks

Gakido vulnerable to HTTP Header Injection (CRLF Injection)

sigstore CSRF possibility in OIDC authentication during signing

GI-DocGen vulnerable to Reflected XSS via unescaped query strings

pytest has vulnerable tmpdir handling

Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true

Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false

Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization

Swing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user

ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard

BlackSheep's ClientSession is vulnerable to CRLF injection

hermes's raw options logging may disclose secrets passed in via subcommand options argument

Weblate wlc has insecure API key configuration

Weblate command-line client susceptible to SSL verification skip

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock

Werkzeug safe_join() allows Windows special device names with compound extensions

NiceGUI has Redis connection leak via tab storage causes service degradation

NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

records-mover Injection vulnerability

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can f

Bokeh server applications have Incomplete Origin Validation in WebSockets

MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download

AIOHTTP vulnerable to DoS through chunked messages

AIOHTTP vulnerable to denial of service through large payloads

AIOHTTP vulnerable to DoS when bypassing asserts

AIOHTTP vulnerable to brute-force leak of internal static file path components

AIOHTTP's unicode processing of header values could cause parsing discrepancies

libsodium has Incomplete List of Disallowed Inputs

CBORDecoder reuse can leak shareable values across decode calls

Home Assistant Core before is vulnerable to Directory Traversal

Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Marshmallow has DoS in Schema.load(many)

Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification

FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation

Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez

mcp-server-git has missing path validation when using --repository flag

mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

Duplicate Advisory: python-jose denial of service via compressed JWE content

filelock has a TOCTOU race condition which allows symlink attacks during lock file creation

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Weblate has a Server-Side Request Forgery issue

Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)

Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration

django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions