Advisory Catalog

MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

WordPress Core Remote File Inclusion Vulnerability

lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel

vllm p2p never connected zmq_exhaustion

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBas

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, c

Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

devalue: `stringify`/`uneval` serialize shared memory

deepmerge mergeObject() allows prototype poisoning of returned objects

source-map-js allows event-loop denial of service through indexed source-map section offsets

Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses

File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

LMDeploy has an SSRF bypass

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that poison

virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

virtualenv: Command injection via --prompt in activate.bat (batch activator)

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the worker restarts.

Acronis Backup Incorrect Default Permissions Vulnerability

Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

djust: A template binding inherits a context safety grant it never earned (XSS)

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

Jupyter Server: 5xx request logging leaks token-bearing Referer header values

libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks

vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust has broken object-level access control (IDOR)

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)