Advisory Catalog

pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

h2: Duplicate Host header could facilitate request smuggling

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials t

praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

Langflow: Weak Fernet Key via random.seed()

MLflow AI Gateway permits SSRF through an unvalidated api_base

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Django GeoDjango vulnerable to denial of service through deeply nested geometry collections

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees