Advisory Catalog

wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

Twisted: IMAP wildcardToRegexp() ReDoS

WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Hydra instantiate target blacklist bypasses permit code execution

Hydra logging configuration permits unsafe callable resolution

Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Hydra: Mutable instantiate policy sets allow target blocklist bypass

Vyper: Memory corruption using function calls within tuples / nested calls

Vyper: Call stack corruption when passing complex type containing non-base type members as argument

Vyper: Return inside for loop more than 1 level deep

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack i

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens t

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checki

Docling imports plugin entry points before the allow_external_plugins check

Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

Docling: Configured HTTP headers sent to every remote image host named by a document

Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration