Advisory Catalog

Rattler vulnerable to package cache path traversal via conda package build string

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Open WebUI: Arena task endpoints can bypass underlying model access controls

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Open WebUI: Account enumeration via observable login timing discrepancy

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

Open WebUI: Stored web worker XSS via Pyodide

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths

pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

RestrictedPython guard hooks can be shadowed via positional-only arguments

asyncssh has SCP Path Traversal to Arbitrary File Write

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elastic

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restric

Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler

`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

pypdf: Possible infinite loop for not terminated inline images

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

LiteLLM: Local file read via request-supplied OIDC file references

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

pypdf: Possible large memory usage for wrong image dimensions

pypdf: Possible long runtimes for repeated malformed cross-reference entries

Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files