Advisory Catalog

django-allauth does not reject access tokens for inactive users

Apache Airflow exposes secret values to authenticated UI users via rendered templates

Tornado vulnerable to Header Injection and XSS via reason argument

Pyrofork has a Path Traversal in download_media Method

HTTP/HTTPS Traffic Interception Bypass in mad-proxy

Open Redirect Vulnerability in Taguette

NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

open-webui is Vulnerable to Incorrect Access Control

Ansible Community General Collection is vulnerable to exposure of sensitive information

arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints

Django is vulnerable to SQL injection in column aliases

trytond does not enforce access rights for data export

trytond allows remote attackers to obtain sensitive trace-back (server setup) information

Werkzeug safe_join() allows Windows special device names

Peppol-py is vulnerable to XXE attacks due to Saxon configuration

OpenStack's Mistral Client has a local file inclusion vulnerability

pypdf's LZWDecode streams be manipulated to exhaust RAM

MLX has Wild Pointer Dereference in load_gguf()

MLX has heap-buffer-overflow in load()

vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or I

OpenEXR has use after free in PyObject_StealAttrString

OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()

changedetection.io: Stored XSS in Watch update via API

AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64

Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode

OctoPrint vulnerable to XSS in Action Commands Notification and Prompt

DSPy does not properly restrict file reads

Byaidu PDFMathTranslate vulnerable to open redirect

Apache Airflow's create action can upsert existing Pools/Connections/Variables

Apache Airflow `/api/v2/dagReports` executes DAG Python in API

Apache Airflow has a command injection vulnerability in "example_dag_decorator"

OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability

uv allows ZIP payload obfuscation through parsing differentials

CKAN vulnerable to fixed session IDs

CKAN vulnerable to stored XSS in resource description

Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery

FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name

FastMCP vulnerable to reflected XSS in client's callback page

pypdf can exhaust RAM via manipulated LZWDecode streams

pypdf possibly loops infinitely when reading DCT inline images without EOF marker

Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization

Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function

Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL

Taguette vulnerable to cross-site scripting via tag name, tag description, document name and document description

Mammoth is vulnerable to Directory Traversal

Apache Spark has Inadequate Encryption Strength

Authlib : JWE zip=DEF decompression bomb enables DoS