Advisory Catalog

TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This call registers the shortened code representation in

Keras: Lambda deserialization can bypass safe mode and execute code

9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

9router: Missing Authorization and OS Command Injection

mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

Langflow: Code Injection Vulnerability in Code Validation Endpoint

Adobe ColdFusion Path Traversal Vulnerability

Joomlack Page Builder Improper Access Control Vulnerability

Kestra OSS OS Command Injection Vulnerability

semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal

motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)

Budibase has nonymous NoSQL operator injection via published-app query templates

expr-eval vulnerable to Code Execution

Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload

Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

scimPatch vulnerable to prototype pollution via unfiltered keys in patch

motionEye: Authentication possible via password hash

Chainlit contains a session hijacking vulnerability

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

jupyterlab-git extension: Stored XSS leading to RCE

Network-AI: Improper Neutralization of Special Elements used in an OS Command

mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

deepstream is vulnerable to prototype pollution

Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE

@acastellon/auth: Authentication bypass via spoofable headers in validateToken()

netlicensing-mcp: REST Path Traversal Bypasses Token Redaction

Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call

npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation

PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool

npm PraisonAI codeMode sandbox escape via Function constructor

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication