Advisory Catalog

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti

tablib: Stored XSS in the HTML export via unescaped dataset title

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Accelerate path traversal and denial of service via sharded checkpoint weight_map entries

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one

Apache Airflow Yandex Lockbox backend allows cross-team secret disclosure

Keras model loading is vulnerable to denial of service through HDF5 shape bombs

JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

pypdf: Possible large memory usage for large /ToUnicode streams

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

NLTK downloader allows cross-package resource and model poisoning

h2: Duplicate Host header could facilitate request smuggling

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials t

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Django GeoDjango vulnerable to denial of service through deeply nested geometry collections

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

AIOHTTP: HTTP request smuggling via WebSocket upgrade

GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Keras: HDF5 links can disclose local file contents

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

OnionShare Receive mode writes uploaded files even when file uploads are disabled

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

pip would incorrectly handle doubly-encoded package URLs from indexes

olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Hugging Face Datasets folder-based builders allow path traversal through file_name metadata

BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab PluginManager lock-rule enforcement bypass

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the

PocketSphinx: Buffer overflows in language and acoustic model loading code

PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs