Advisory Catalog

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

pypdf: Unvalidated JPEG image data loading

djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

virtualenv: Pip seeding with download omits wheel digest verification

virtualenv: Venv configuration readback can reinterpret path boundaries

virtualenv: Downloaded wheel selection and caching precede verification

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

ClickMigrate has Path Traversal in "revision -m" argument

Strawberry legacy graphql-ws retains naturally completed subscription slots

Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack i

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

wlc may disclose API tokens to project-configured URLs

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests

kas Persistently Disables SSH Host Key Checking

NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure

Wagtail: Identification of documents by SHA1 hash

MobSF has SSRF port restriction bypass in assetlinks_check

NLTK network URL validation permits SSRF to RFC 6598 shared-address-space hosts

datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

Apprise forwards configured auth headers across cross-origin HTTP redirects

Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

LiteLLM: Local file read via request-supplied OIDC file references

BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above

BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement.

Django: cache middleware may expose private responses when unrelated request cookies are present

Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

Kiwi TCMS's /init-db/ page renders and responds to requests after first use

BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader

BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints

BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens

LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration

LiteLLM: M2M JWT Handler Has Improper Authorization

LiteLLM: Admin Key Handler Has Improper Authorization

PGHoard: Password written to debug log

BBOT: Symlink-Following Arbitrary Write via github_workflows Module