Advisory Catalog

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

MPXJ: XXE Vulnerability in MerlinReader

psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

MCP Atlassian: SSRF Protection Bypass

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

mcp-atlassian has an incomplete SSRF remediation

MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel

vllm p2p never connected zmq_exhaustion

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBas

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, c

Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

LMDeploy has an SSRF bypass

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that poison

virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

virtualenv: Command injection via --prompt in activate.bat (batch activator)

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the worker restarts.

djust: A template binding inherits a context safety grant it never earned (XSS)

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

Jupyter Server: 5xx request logging leaks token-bearing Referer header values

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust has broken object-level access control (IDOR)

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Ka

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)