Advisory Catalog

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This call registers the shortened code representation in

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling's check_safety() function returns LIKELY_SAFE with

Linux Kernel Unspecified Vulnerability

NLTK Stanford wrapper classes execute untrusted JAR files without verification

Gitea forwarded-proto validation allows canonical URL spoofing

Gitea pre-receive hook scanner errors allow branch-protection bypass

Gitea release asset dumps permit path traversal through crafted names

Gitea exposes tracked time entries without repository authorization

Gitea repository creation accepts insufficiently validated fields

Gitea pull request branch permission checks allow unauthorized updates and rebases

Gitea organization permission APIs expose hidden membership and private organization data

Gitea template repository generation follows unsafe filesystem paths

Gitea tracked-time deletion is not scoped to the requested issue

Gitea OAuth2 authorization codes can be reused after expiry

Gitea OAuth2 PKCE S256 verifier bypass

Gitea LFS mirror operations bypass migration HTTP transport protections

Gitea git grep searches allow server resource exhaustion

Gitea primary email ownership bypass allows cross-user email changes

Gitea draft releases and attachments are exposed without write permission

Keras: Lambda deserialization can bypass safe mode and execute code

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints