Advisory Catalog

MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it

MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

mem0ai Databricks vector store vulnerable to SQL injection

Pillow multi-frame loaders can reuse stale native image storage after mode transitions

vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

certifi bundles emSign root CAs with compromised intermediate CA keys

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Pillow: Heap buffer overflow in ImagingJpegDecode

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

Mercury: Unauthenticated Remote Code Execution via /api/kernels

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution

PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

PyJWT: PyJWKClient follows redirects when fetching JWKS

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

Authlib: empty signatures validation in JWS JSON deserialization

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Home Assistant: XSS in Statistics Graph Card

plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

djust has an authorization bypass on the WebSocket/SSE mount path

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

plone.app.event vulnerable to denial of service via iCalendar import

plone.app.portlets vulnerable to denial of service via RSS feed portlet

LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The on

openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the manifest,

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor,

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes vis

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silen