Advisory Catalog

utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

Tornado has out-of-bounds memory access via C extension

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections,

ChromaDB has a code injection vulnerability

ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

WsgiDAV encoded dot segments can escape filesystem share roots

Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

Keras archive extraction utilities allow path traversal and arbitrary file writes

python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token