Advisory Catalog

The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.

Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

Neo4j Cypher MCP server is vulnerable to DNS rebinding

xml2rfc is vulnerable to arbitrary file reads through prepped files

PyInstaller has local privilege escalation vulnerability

OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload

Monai: Unsafe use of Pickle deserialization may lead to RCE

MONAI: Unsafe torch usage may lead to arbitrary code execution

MONAI does not prevent path traversal, potentially leading to arbitrary file writes

Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation

TkEasyGUI Affected by Uncontrolled Search Path Element Issue

pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability

Langchain Community Vulnerable to XML External Entity (XXE) Attacks

Django is subject to SQL injection through its column aliases

ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more

Picklescan is missing detection when calling built-in python library asyncio.unix_events._UnixSubprocessTransport._start

Picklescan is missing detection when calling built-in python cProfile.run

Picklescan is missing detection when calling built-in Python cProfile.runctx

Picklescan is missing detection when calling built-in python doctest.debug_script

Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode

Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand

Picklescan is missing detection when calling built-in python idlelib.run.Executive.runcode

Picklescan is missing detection when calling built-in python lib2to3.pgen2.pgen.ParserGenerator.make_label

Picklescan is missing detection when calling built-in python ensurepip._run_pip

Picklescan is missing detection when calling pytorch function torch.utils.bottleneck.__main__.run_autograd_prof

Picklescan has a missing detection when calling built-in python library idlelib.calltip.get_entity

Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip

Picklescan has a missing detection when calling built-in python code.InteractiveInterpreter

Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions

Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity

Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem

Picklescan has a missing detection when calling built-in python lib2to3.pgen2.grammar.Grammar.loads

Picklescan has a missing detection when calling built-in python profile.Profile.runctx

Picklescan has a missing detection when calling built-in python profile.Profile.run

Picklescan has a missing detection when calling built-in python trace.Trace.runctx

Picklescan has a missing detection when calling built-in python trace.Trace.run

xml2rfc has an arbitrary file read vulnerability

XGrammar affected by Denial of Service by infinite recursion grammars

Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)

LlamaIndex affected by a Denial of Service (DOS) in JSONReader

Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config

Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper

Picklescan missing detection when calling pytorch function torch.utils.data.datapipes.utils.decoder.basichandlers

Picklescan missing detection when calling pytorch function torch.utils.collect_env.run

Picklescan missing detection when calling pytorch function torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression

Picklescan missing detection when calling pytorch function torch._dynamo.guards.GuardBuilder.get

Picklescan missing detection when calling pytorch function torch.utils.bottleneck.__main__.run_cprofile

Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder