Advisory Catalog

LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even

Modular Max Serve has Unsafe Deserialization vulnerability

joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

cbor2 C extension decoder flaws can cause denial of service

OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

AstrBot is vulnerable to RCE with hard-coded JWT signing keys

pgAdmin has vulnerability in LDAP authentication mechanism that allows bypassing TLS certificate verification

pgAdmin is affected by an LDAP injection vulnerability

pgAdmin 4 has command injection vulnerability on Windows systems

pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or I

An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization, leading to a Denial of Service (DoS).

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input

OpenEXR has use after free in PyObject_StealAttrString

OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()

OpenEXR Makes Use of Uninitialized Memory

changedetection.io: Stored XSS in Watch update via API

AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

AstrBot contains a directory traversal vulnerability