Advisory Catalog

JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

msgpack5: Truncated map32 headers throw an unexpected error

msgpack5: Partial options disable prototype protection

msgpack5: Many buffered values can exhaust the streaming decoder stack

msgpack5: Reserved byte can cause unbounded stream buffering

msgpack5: Deeply nested input can exhaust the decoder stack

msgpack5: Quadratic parsing in the streaming decoder

msgpack5: Decoding negative int64 values mutates the input buffer

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early