Advisory Catalog

x402 SDK Security Advisory

mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft

SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality

Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure

Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer

mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint

NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbit

LangGraph checkpoint loading has unsafe msgpack deserialization

RAGAS has an Arbitrary File Read vulnerability

xgrammar vulnerable to DoS via multi-layer nesting

Python-Markdown has an Uncaught Exception

django-allauth has an open redirect vulnerability

dbt-common's commonprefix() doesn't protect against path traversal

pyLoad has an Arbitrary File Write via Path Traversal in edit_package()

eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write

Fickling missing RCE-capable modules in UNSAFE_IMPORTS

Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked

changedetection.io has Zip Slip vulnerability in the backup restore functionality

changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()

changedetection.io has Reflected XSS in its RSS Tag Error Response

Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links

NLTK has a Path Traversal issue

PickleScan has multiple stdlib modules with direct RCE not in blocklist

PickleScan's pkgutil.resolve_name has a universal blocklist bypass

PickleScan's profile.run blocklist mismatch allows exec() bypass

Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction

OpenViking contains a Path Traversal vulnerability

Django has a Race Condition vulnerability

Django vulnerable to Uncontrolled Resource Consumption

pypdf vulnerable to inefficient decoding of ASCIIHexDecode streams