Advisory Catalog

plone.restapi: Stored XSS by spoofing mime type

plone.app.textfield: Stored XSS by spoofing mime type

Pixeldrain API key shared with unverified thirdparty sites

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments

Keras: tar extraction permits symlink-based path traversal

Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs. A vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 through 1.2.1. Users are recommended to upgrade to ve

PyOD persistence.load deserializes untrusted artifacts before validation

PraisonAI: Project custom command templates can read outside-workspace files into model prompts

CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources

MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)

PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

PraisonAI: Project config can auto-save agent output outside the project root

PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked

psd-tools vulnerable to arbitrary file write via smart-object filename

Rattler vulnerable to package cache path traversal via conda package build string

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Open WebUI: Arena task endpoints can bypass underlying model access controls

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Open WebUI: Account enumeration via observable login timing discrepancy

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elastic

Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

pypdf: Possible large memory usage for wrong image dimensions

pypdf: Possible long runtimes for repeated malformed cross-reference entries

Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Mistune: XSS via unescaped class option in Admonition directive

Mistune: Arbitrary File Read via Include directive path traversal

Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion

ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path

aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

Django: GDALRaster may over-read heap memory when constructed from bytes