Advisory Catalog

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

weasyprint Has Server-Side Request Forgery (SSRF)

SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Snowflake drivers writes sensitive information to logs

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

Apache Spark History Server allows stored cross-site scripting through unescaped application names

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

pypdf: Possible long runtimes/large memory usage when retrieving outlines

pypdf: Possible infinite loop for TreeObject.insert_child

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

AIIR verification and policy gates could report success without enforcing the control (fail-open)

NLTK: Downloader.download follows hardlinks and overwrites outside-root files

NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_c

openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/

In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main passwor

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successful exploit of this vulnerability might lead to information disclosure and data tampering.

eml_parser has parser DoS via deeply nested parentheses in e-mail headers

eml_parser has a URL extraction bypass via HTML entities in URLs

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing p

NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Wagtail: Improper restriction handling on Page translation API endpoint

Wagtail: Improper permission handling when copying snippets