Advisory Catalog

MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files

MONAI vulnerable to OS command injection

Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

MeshCentral has unsanitized data fields

GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

@rhinostone/swig: arbitrary local file read via include/extends path traversal

CodeWhale: js_execution leaks parent environment to model context via missing env scrub

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)

Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard

Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

Etherpad has stored XSS in HTML export via unescaped attribute-pool values

vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

sqlparse: Quadratic O(n²) DoS in group_comments

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

extract-zip allows arbitrary file writes through symlink archive entries

Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

DeepmergeTS has stack exhaustion when merging recursive object graphs

openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.

openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords pr

openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_ope

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Grav CMS vulnerable to remote code execution via .zip file upload

Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS