Advisory Catalog

DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Open WebUI: Stored web worker XSS via Pyodide

Cognee allows non-superusers to overwrite global LLM configuration

Apache Airflow allows code execution through unsafe serialized DAG deserialization

Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879

Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to w

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allow

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This call registers the shortened code representation in

Keras: Lambda deserialization can bypass safe mode and execute code

fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

Langflow: Code Injection Vulnerability in Code Validation Endpoint

semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal

motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)

motionEye: Authentication possible via password hash

Chainlit contains a session hijacking vulnerability

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

jupyterlab-git extension: Stored XSS leading to RCE

mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE

netlicensing-mcp: REST Path Traversal Bypasses Token Redaction

Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

python-statemachine SCXML <data expr> Eval Injection

Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

LangGraph SDK has unsafe URL path construction