Advisory Catalog

Indico: Cross-Site-Scripting in minutes editor

Indico: Cross-Site-Scripting in link fields

Indico: Missing access check in legacy session export API

Indico: Incomplete Server-Side Request Forgery (SSRF) check

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger: API credentials remain valid after logout/password change

wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

Twisted: IMAP wildcardToRegexp() ReDoS

Vyper: Return inside for loop more than 1 level deep

Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checki

Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

Docling: Configured HTTP headers sent to every remote image host named by a document

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

uv: Path traversal on Windows through wheel extraction

geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been p

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

urllib3: Chunked Deflate streaming can enter an infinite loop

Werkzeug safe_join() allows Windows special device names

Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.snowflakecomputing.com/api/v2/statements`, so an `account` value containing `/`, `?` or `#` demotes the

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clau

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption