Advisory Catalog

JustHTML has a Sanitizer Bypass (in Markdown)

JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)

Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT

dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py

Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution

PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution

pypdf has inefficient decoding of array-based streams

Frigte has broken access control viewer user can delete admin and other users account

UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

UltraJSON has a Memory Leak parsing large integers allows DoS

Langflow is Missing Ownership Verification in API Key Deletion (IDOR)

Ray Dashboard is vulnerable to path traversal through its static file handling mechanism

Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

Denial of Service in pyasn1 via Unbounded Recursion

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutati

Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications

Apache Airflow: DAG authorization bypass

Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata