Advisory Catalog

pgAdmin has vulnerability in LDAP authentication mechanism that allows bypassing TLS certificate verification

pgAdmin is affected by an LDAP injection vulnerability

pgAdmin 4 has command injection vulnerability on Windows systems

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input

AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

AstrBot contains a directory traversal vulnerability

Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

Dosage vulnerable to a Directory Traversal through crafted HTTP responses

Agno session state overwrites between different sessions/users

Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations.

Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtractionWorker template function when processing GLTF accessor data.

cryptidy allows code execution via untrusted data due to pickle.loads

Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Keras Directory Traversal Vulnerability

LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore

FastMCP Auth Integration Allows for Confused Deputy Account Takeover

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

LangGraph's SQLite store implementation has a SQL Injection Vulnerability

aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server

Taguette password reset link poisoning

Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name

llama-index has Insecure Temporary File

Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters

vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class

LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities

vLLM is vulnerable to timing attack at bearer auth

LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing

Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion

ZenML is vulnerable to Path Traversal through its `PathMaterializer` class

motionEye vulnerable to RCE via unsanitized motion config parameter

llama-index-core insecurely handles temporary files

Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies

Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles

An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor.

A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS).

A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS).

A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).

pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.

An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation.

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

CodeChecker has a buffer overflow in the log command

Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

Keras is vulnerable to Deserialization of Untrusted Data