Advisory Catalog

VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files

Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser

Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text

flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument

Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN

py7zr: Arbitrary File Write Vulnerability

js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call

Statamic CMS's unsafe method invocation via collection sorting allows data destruction

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

parse-server: Denial of service via exponential-time processing of deeply nested query operators

Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication

PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service

spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation

Crawl4AI: Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)

budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)

AgenticMail: Cross-agent task authorization bypass in AgenticMail API

[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat

[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions

[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat

Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

Kirby: `pages.access` permission is not checked in the `site/find` REST API route

Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`

Kirby: Self cross-site scripting (self-XSS) in the writer field

MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml

npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

npm PraisonAI AgentLoop onToolCall approval runs after tool execution

npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients