Advisory Catalog

Apache Airflow exposes deferred trigger kwargs in task-instance API responses

apache-airflow DAG source authorization bypass exposes co-located DAG source

Apache Airflow exposes secrets backend credentials through the Config API

Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph

Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API

Apache Airflow allows code execution through unsafe serialized DAG deserialization

Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint

Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

vLLM denial of service via prompt embeds on M-RoPE models

vLLM has Remote DoS via Invalid Recovered Token Reinjection

Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command

Langroid: handle_message() executes user-supplied tool JSON without sender verification

Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

vLLM: Speech-to-text upload size limit is enforced after full UploadFile read

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`

flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf

WeasyPrint has CSS Injection via Presentational Hints

Apache Airflow Google provider allows path traversal through GCS object names

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to w

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allow

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.  Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). Th

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This call registers the shortened code representation in

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling's check_safety() function returns LIKELY_SAFE with

NLTK Stanford wrapper classes execute untrusted JAR files without verification

Keras: Lambda deserialization can bypass safe mode and execute code