Advisory Catalog

Fickling has a bypass via runpy.run_path() and runpy.run_module()

pypdf has possible long runtimes for malformed startxref

pypdf has possible long runtimes for missing /Root object with large /Size values

vLLM introduced enhanced protection for CVE-2025-62164

Werkzeug safe_join() allows Windows special device names with compound extensions

Authlib has 1-click Account Takeover vulnerability

picklescan has Arbitrary file read using `io.FileIO`

NiceGUI has Redis connection leak via tab storage causes service degradation

NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS

NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

wolfSSL Python module vulnerable to Improper Authentication

records-mover Injection vulnerability

loggingredactor converts non-string types to string types in logs

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can f

terminal-controller-mcp vulnerable to Command Injection

Parsl Monitoring Visualization Vulnerable to SQL Injection

Bokeh server applications have Incomplete Origin Validation in WebSockets

MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download

AIOHTTP Vulnerable to Cookie Parser Warning Storm

AIOHTTP vulnerable to DoS through chunked messages

AIOHTTP vulnerable to denial of service through large payloads

AIOHTTP vulnerable to DoS when bypassing asserts

AIOHTTP vulnerable to brute-force leak of internal static file path components

AIOHTTP has unicode match groups in regexes for ASCII protocol elements

AIOHTTP's unicode processing of header values could cause parsing discrepancies

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

badkeys vulnerable to ASCII control character injection on console via malformed input

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investigation cases. However, the mutation lack

ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)