Advisory Catalog

Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

Authlib JWS JWK Header Injection: Signature Verification Bypass

SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker

MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment

vLLM has SSRF Protection Bypass

NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbit

PickleScan has multiple stdlib modules with direct RCE not in blocklist

PickleScan's pkgutil.resolve_name has a universal blocklist bypass

PickleScan's profile.run blocklist mismatch allows exec() bypass

OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

Langflow has Remote Code Execution in CSV Agent

Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sandboxing mechanism for user-supplied evaluator code, but incorrectly whitelisted the `numpy` package a

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering

ormar is vulnerable to SQL Injection through aggregate functions min() and max()

Sentry: Improper authentication on SAML SSO process allows user identity linking

MLflow Use of Default Password Authentication Bypass Vulnerability

Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

NLTK has a Zip Slip Vulnerability

Skill-scanner Unsecured Network Binding Vulnerability

Weblate has an argument injection in management console

DiskCache has unsafe pickle deserialization

Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE

Keylime Missing Authentication for Critical Function and Improper Authentication

A single post-release of dydx-v4-client contained obfuscated multi-stage loader

Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK

EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write

Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication

picklescan missing detection by simple obfuscation of a `builtins.eval` call

Langroid has WAF Bypass Leading to RCE in TableChatAgent

vLLM has RCE In Video Processing

H2O has an External Control of File Name or Path vulnerability

CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection

Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)

dcap-qvl has Missing Verification for QE Identity

Langflow affected by Remote Code Execution via validate_code() exec()

docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage

vLLM affected by RCE via auto_map dynamic module loading during model initialization

Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter

Crawl4AI Has Local File Inclusion in Docker API via file:// URLs

MindsDB has improper sanitation of filepath that leads to information disclosure and DOS

Salesforce Uni2TS has a Code Injection vulnerability

wolfSSL Python module vulnerable to Improper Authentication

terminal-controller-mcp vulnerable to Command Injection

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lack

Picklescan has Incomplete List of Disallowed Inputs