Advisory Catalog

Hydra: Mutable instantiate policy sets allow target blocklist bypass

Vyper: Memory corruption using function calls within tuples / nested calls

Vyper: Call stack corruption when passing complex type containing non-base type members as argument

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens t

Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Docling imports plugin entry points before the allow_external_plugins check

Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Vibe-Trading file-read tools expose arbitrary server-readable files

LangGraph SDK custom auth silently ignores actions= on resource decorators

Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

pypdf: Possible large memory usage when retrieving alphabetical page labels

pypdf: Possible long runtimes with large amount of embedded files

pypdf: Possible long runtimes when generating appearance streams

pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

pypdf: Possible large memory usage when parsing font data

pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

pypdf: Possible long runtimes/large memory usage when parsing indirect objects

pypdf: Possible large memory usage when retrieving Roman page labels

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

PyJWT accepts public JWK containers as HMAC secrets

PyJWT BOM Bypass

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eva

In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/util

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passes $ expressions to Python eval(). Attackers can publish a malicious bundle with crafted configuration c

GitPython submodule update path traversal can write outside the repository

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeat

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids

vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-prompt item limits). Across four ingress paths — the shared medi

khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs

PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding