Advisory Catalog

PraisonAI Vulnerable to OS Command Injection

Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution

Django vulnerable to privilege abuse in GenericInlineModelAdmin

LoLLMs is vulnerable to Improper Access Control through weak secret key

PraisonAI Has Path Traversal in FileTools

PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator

changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering

pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)

BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation

LiteLLM: Authentication bypass via OIDC userinfo cache key collision

mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

pymetasploit3 vulnerable to command injection in console.run_module_with_output()

Kedro has Arbitrary Code Execution via Malicious Logging Configuration

Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`

PraisonAI Has Authentication Bypass via OAuthManager.validate_token()

PraisonAI Has Missing Authentication in WebSocket Gateway

PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox

PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`

PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution

PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code

openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage

openssl-encrypt's unverified key bundle from_dict() + to_identity() path allows encryption to attacker keys

openssl-encrypt silently skips schema validation when jsonschema library is not installed

openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart

openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

Mlflow: Command Injection when serving models with enable_mlserver=True

SciTokens is vulnerable to SQL Injection in KeyCache

Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2

MLflow Command Injection vulnerability

MLFlow path traversal vulnerability

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-related endpoints, and lacks the `Depends(get_current_activ

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

Langflow has Authenticated Code Execution in Agentic Assistant Validation

OpenHands is Vulnerable to Command Injection through its Git Diff Handler

Two LiteLLM versions published containing credential harvesting malware

NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution

NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading

Langflow has an Arbitrary File Write (RCE) via v2 API

ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor

Arbitrary file write via tar traversal in mlflow

JustHTML has a Sanitizer Bypass (in Markdown)

Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py

Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`