Advisory Catalog

utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion

utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target

PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

praisonaiagents: AgentServer declares auth_token but never enforces it on any route

praisonaiagents web_crawl vulnerable to SSRF via redirect-following

NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses

NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()

GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol

NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read

NLTK: Default ENFORCE=False Disables All pathsec Security Controls

NLTK: Stable FrameNet and NKJP readers parse outside-root XML

NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py

Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files

MONAI vulnerable to OS command injection

Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger