Advisory Catalog

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization

TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters

LangBot: Authenticated RCE Via MCP Configuration

garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

PraisonAI: SkillTools Executes Scripts Without Path Containment Validation

PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities

json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS

crewai-tools SSRF redirect bypass exposes internal services

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability. The specific flaw exists with

DIRAC: SQL injection and lack of access control in PilotManager service

DIRAC: Pilot code downloaded over unverified HTTPS connection

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

mcp-atlassian: Arbitrary server-side file read via attachment upload

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

PraisonAI: Shell command allowlist bypass via find -exec built-in action

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)