PyPI incidents

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

django-cms: before 5.0.8

asteval has a Sandbox Escape via BaseException Subclasses

asteval has a Sandbox Escape via BaseException Subclasses

asteval: before 1.0.9

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

langgraph-checkpoint-mongodb: before 0.3.0

Wagtail: Improper permission handling in image preview

Wagtail: Improper permission handling in image preview

wagtail: before 7.0.8

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

django-cms: before 5.0.9

django CMS: Structure endpoint bypasses page-view permission

django CMS: Structure endpoint bypasses page-view permission

django-cms: before 5.0.8

Wagtail: Reflected XSS in dynamic image URL generator view

Wagtail: Reflected XSS in dynamic image URL generator view

wagtail: 7.3 → 7.3.3

asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

asteval: before 1.0.9

Wagtail: Improper restriction handling on Page translation API endpoint

Wagtail: Improper restriction handling on Page translation API endpoint

wagtail: before 7.0.9

Wagtail: Improper permission handling when copying snippets

Wagtail: Improper permission handling when copying snippets

wagtail: before 7.0.9

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

django-cms: before 5.0.8

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

mobsf: before 4.5.1

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

lemur: before 1.9.3

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

lemur: before 1.9.3

MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

mobsf: before 4.5.1

GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

geolens: before 1.2.3

MLflow: trace API endpoints lack proper authorization validators

MLflow: trace API endpoints lack proper authorization validators

mlflow: 2.14.0rc0 → 3.13.0rc0

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

mlflow: before 3.15.0

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

pydantic-ai-slim: 1.65.0 → 1.106.0

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

pydantic-ai: 1.65.0 → 1.106.0

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

geolens: before 1.2.4

langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

langgraph-api: before 0.10.0

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

copier: 9.5.0 → 9.15.2

langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api: before 0.10.0

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

mcp-contextforge-gateway: before 1.0.3

Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding

Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding

homeassistant: before 2026.6.0

MobSF's CSRF checks not enforced after Django migration

MobSF's CSRF checks not enforced after Django migration

mobsf: before 4.5.1

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

mcp-atlassian: before 0.22.0

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

glances: before 4.5.6

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

lemur: before 1.9.3

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

sqlparse: before 0.6.0

vLLM: Completion prompt lists fan out into unbounded engine requests

vLLM: Completion prompt lists fan out into unbounded engine requests

vllm: 0.19.0 → 0.26.0

libp2p: yamux connection DoS via oversized data frame

libp2p: yamux connection DoS via oversized data frame

libp2p: all versions

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

linuxfabrik-lib: before 6.1.0

GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

geolens-cli: before 1.2.3

Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

lemur: before 1.9.3

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

lemur: 0.5.0 → 1.9.3

MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

mobsf: before 4.5.1

MONAI vulnerable to OS command injection

MONAI vulnerable to OS command injection

monai: before 1.6.0

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

lemur: before 1.9.3

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

lemur: before 1.9.3

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

linuxfabrik-lib: before 6.1.0

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

lemur: before 1.9.3

MobSF's CSRF checks not enforced after Django migration

MobSF's CSRF checks not enforced after Django migration

mobsf: before 4.5.1

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

lemur: 0.5.0 → 1.9.3

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

mobsf: before 4.5.1

Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

lemur: before 1.9.3

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

glances: before 4.5.6

sqlparse: Quadratic O(n²) DoS in group_comments

sqlparse: Quadratic O(n²) DoS in group_comments

sqlparse: before 0.6.0

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

glances: before 4.5.6

Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

glances: before 4.5.6

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

sqlparse: before 0.6.0

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

sqlparse: before 0.6.0

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

mlflow: before 3.15.0

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

mcp-contextforge-gateway: before 1.0.3

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

atomic-agents-stack: before 1.1.0

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

nltk: before 3.10.0

vLLM: Completion prompt lists fan out into unbounded engine requests

vLLM: Completion prompt lists fan out into unbounded engine requests

vllm: 0.19.0 → 0.26.0

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

pydantic-ai-slim: 1.65.0 → 1.106.0

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

ansible-jailexec: before 2.0.0

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configurat

apache-airflow: before 3.3.1

Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submit

Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those se

apache-airflow: before 3.3.1

compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

compliance-trestle: before 4.1.0

Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates

Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

apache-airflow: before 3.3.1

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` pa

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic's `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces to `1`); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit permission on any single Dag could therefore

apache-airflow: before 3.3.1

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when re

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unus

apache-airflow-providers-google: before 22.3.0

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

open-webui: 0.9.0 → 0.11.0

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

awscli: before 1.45.28

pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

pymdown-extensions: before 11.0.1

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

open-webui: before 0.11.0

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

open-webui: 0.9.6 → 0.11.0

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

open-webui: 0.10.0 → 0.11.0

Keras: HDF5 virtual datasets can disclose local files

Keras: HDF5 virtual datasets can disclose local files

keras: before 3.12.3

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

open-webui: 0.8.0 → 0.11.0

Keras: HDF5 links can disclose local file contents

Keras: HDF5 links can disclose local file contents

keras: before 3.12.3

Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI: DNS Rebinding SSRF Bypass

open-webui: before 0.11.0

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

open-webui: 0.9.6 → 0.11.0

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

open-webui: 0.10.0 → 0.11.0

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

open-webui: 0.9.0 → 0.11.0

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

open-webui: 0.8.8 → 0.11.0

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

open-webui: 0.9.0 → 0.11.0

aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

aiosend: before 3.0.7

The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id

The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backe

apache-airflow-providers-yandex: before 4.5.1

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling

apache-airflow-providers-amazon: before 9.34.0

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

langgraph-checkpoint-postgres: before 3.1.1

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

langgraph-checkpoint-sqlite: before 3.1.1

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

gitpython: before 3.1.58

GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

gitpython: before 3.1.58

GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

gitpython: before 3.1.58

pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

pymdown-extensions: before 11.0.1

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

awscli: before 1.45.28

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

langgraph-checkpoint-postgres: before 3.1.1

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

datamodel-code-generator: 0.9.1 → 0.61.0

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

penelope-shell-handler: before 0.20.0

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

open-webui: 0.9.5 → 0.10.0

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

thumbor: before 7.8.0

Open WebUI: Stored web worker XSS via Pyodide

Open WebUI: Stored web worker XSS via Pyodide

open-webui: before 0.10.0

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

open-webui: 0.9.2 → 0.10.0

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

flyto-core: before 2.26.7

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

nltk: before 3.10.0

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

proot-distro: before 5.1.6

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

nltk: before 3.10.0

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

onionshare-cli: before 2.6.4

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

nltk: before 3.10.0

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

nltk: before 3.10.0

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

flyto-core: before 2.26.7

AWS CLI: Overly permissive File Permissions

AWS CLI: Overly permissive File Permissions

awscli: before 1.44.78

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

thumbor: before 7.8.0

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

open-webui: 0.9.0 → 0.10.0

pytonapi has a Webhook Custom Path Authentication Bypass

pytonapi has a Webhook Custom Path Authentication Bypass

pytonapi: 2.0.0 → 2.2.1

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

thumbor: before 7.8.0

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

proot-distro: before 5.1.5

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

gemini-bridge: 1.0.0 → 1.3.1

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

flyto-core: before 2.26.7

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

datamodel-code-generator: 0.59.0 → 0.62.0

Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

flyto-core: before 2.26.7

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

flyto-core: before 2.26.7

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

datamodel-code-generator: before 0.63.0

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator: 0.9.1 → 0.61.0

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

bedrock-agentcore: before 1.18.1

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

datamodel-code-generator: before 0.62.0

awxkit has a path traversal vulnerability

awxkit has a path traversal vulnerability

awxkit: all versions

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

thumbor: before 7.8.0

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

open-webui: 0.9.6 → 0.10.0

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

thumbor: before 7.8.0

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

flyto-core: before 2.26.7

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

open-webui: before 0.10.0

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

open-webui: 0.9.0 → 0.11.0

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

open-webui: 0.9.6 → 0.11.0

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

open-webui: 0.8.8 → 0.11.0

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

open-webui: 0.8.0 → 0.11.0

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

open-webui: 0.10.0 → 0.11.0

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

open-webui: 0.10.0 → 0.11.0

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

open-webui: 0.9.6 → 0.11.0

Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI: DNS Rebinding SSRF Bypass

open-webui: before 0.11.0

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

open-webui: before 0.11.0

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

open-webui: 0.9.0 → 0.11.0

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

open-webui: 0.9.0 → 0.11.0

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

aiohttp: before 3.14.3

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

cryptography: 44.0.0 → 50.0.0

GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()

GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()

gitpython: before 3.1.57

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

gitpython: before 3.1.57

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

cryptography: before 49.0.0

Keras: HDF5 links can disclose local file contents

Keras: HDF5 links can disclose local file contents

keras: before 3.12.3

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

nltk: before 3.10.0

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

onionshare-cli: before 2.6.4

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

nltk: before 3.10.0

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

thumbor: before 7.8.0

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

nltk: before 3.10.0

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

thumbor: before 7.8.0

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

gemini-bridge: 1.0.0 → 1.3.1

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

thumbor: before 7.8.0

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

thumbor: before 7.8.0

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

thumbor: before 7.8.0

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

thumbor: before 7.8.0

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

nltk: before 3.10.0

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

flyto-core: before 2.26.7

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

flyto-core: before 2.26.7

Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

flyto-core: before 2.26.7

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

flyto-core: before 2.26.7

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

flyto-core: before 2.26.7

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

flyto-core: 2.26.6 → 2.26.7

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

penelope-shell-handler: before 0.20.0

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

proot-distro: before 5.1.6

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

proot-distro: before 5.1.5

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary lo

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from a

pip: before 26.2

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

datamodel-code-generator: before 0.62.0

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

datamodel-code-generator: 0.9.1 → 0.61.0

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator: 0.9.1 → 0.61.0

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

datamodel-code-generator: before 0.63.0

pytonapi has a Webhook Custom Path Authentication Bypass

pytonapi has a Webhook Custom Path Authentication Bypass

pytonapi: 2.0.0 → 2.2.1

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

datamodel-code-generator: 0.59.0 → 0.62.0

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

bedrock-agentcore: before 1.18.1

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

gitpython: before 3.1.55

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

open-webui: before 0.10.0

libp2p: yamux connection DoS via oversized data frame

libp2p: yamux connection DoS via oversized data frame

libp2p: all versions

GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

gitpython: before 3.1.54

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

open-webui: 0.9.2 → 0.10.0

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

httplib2: before 0.32.0

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

open-webui: 0.9.0 → 0.10.0

Open WebUI: Stored web worker XSS via Pyodide

Open WebUI: Stored web worker XSS via Pyodide

open-webui: before 0.10.0

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

open-webui: 0.9.6 → 0.10.0

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

vantage6: all versions

AWS CLI: Overly permissive File Permissions

AWS CLI: Overly permissive File Permissions

awscli: before 1.44.78

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

open-webui: 0.9.5 → 0.10.0

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

pypdf: before 6.14.2

pypdf: Possible infinite loop for not terminated inline images

pypdf: Possible infinite loop for not terminated inline images

pypdf: before 6.14.1

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

jupyterlab: 4.6.0 → 4.6.2

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

jupyterlab: 4.6.0 → 4.6.2

GitPython unsafe clone option gate bypass through joined short options

GitPython unsafe clone option gate bypass through joined short options

gitpython: 3.1.50 → 3.1.51

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

pyasn1: before 0.6.4

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

gitpython: before 3.1.52

Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding

Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding

homeassistant: before 2026.6.0

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMR

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.

capstone: before 5.0.8

vLLM denial of service via prompt embeds on M-RoPE models

vLLM denial of service via prompt embeds on M-RoPE models

vllm: 0.12.0 → 0.24.0

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

vllm: before 0.24.0

Prompty: Arbitrary file read via file reference expansion

Prompty: Arbitrary file read via file reference expansion

prompty: before 2.0.0b2

vLLM has Remote DoS via Invalid Recovered Token Reinjection

vLLM has Remote DoS via Invalid Recovered Token Reinjection

vllm: 0.17.1 → 0.24.0

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

ddtrace: before 4.8.2

OpenStack Ironic has an Incorrect Resource Transfer Between Spheres

OpenStack Ironic has an Incorrect Resource Transfer Between Spheres

ironic-python-agent: before 26.1.6

PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands

PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands

praisonaiagents: before 4.5.128

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

mcp-atlassian: before 0.22.0

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSources/{dag_id}` — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not authorized to read, bypassing per-DAG read authorization. Deployments that co-locate multiple Dags in a single file and rely on per-DAG access control to limit source visibility are affected; single-Dag-p

apache-airflow: before 3.3.0

apache-airflow DAG source authorization bypass exposes co-located DAG source

apache-airflow DAG source authorization bypass exposes co-located DAG source

apache-airflow: before 3.3.0

Pulp incorrectly assigns RBAC permissions in tasks that create objects

Pulp incorrectly assigns RBAC permissions in tasks that create objects

pulpcore: all versions

fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

fast-mcp-telegram: before 0.19.1

MLflow: trace API endpoints lack proper authorization validators

MLflow: trace API endpoints lack proper authorization validators

mlflow: 2.14.0rc0 → 3.13.0rc0

Keras: HDF5 virtual datasets can disclose local files

Keras: HDF5 virtual datasets can disclose local files

keras: before 3.12.3

NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAF

NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` checks for literal `../` sequences but fails to account for percent-encoded traversal sequences such as `..%2f`. The `url2pathname()` function decodes these sequences after the validation step, allowing an attacker to bypass the protection. This vulnerability enables an attacker to read arbitrary files accessible to the Python process b

nltk: all versions

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/cras

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

msgpack: before 1.2.1

Flawfinder output manipulation via untrusted filenames and source text

Flawfinder output manipulation via untrusted filenames and source text

flawfinder: before 2.0.20

OctoPrint has possible file exfiltration via query parameters on upload endpoints

OctoPrint has possible file exfiltration via query parameters on upload endpoints

octoprint: before 1.11.8

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

msgpack: before 1.2.1

stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)

stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)

stigmem-node: before 0.9.0a12

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

ouroboros-ai: before 0.42.1

stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)

stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)

stigmem-node: before 0.9.0a12

stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)

stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)

stigmem-node: before 0.9.0a12

OpenStack Horizon RC file generation does not escape special characters in project names

OpenStack Horizon RC file generation does not escape special characters in project names

horizon: all versions

LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

langchain: before 1.3.9

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

meta-ads-mcp: before 1.0.109

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary become

keras: before 3.14.0

vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method

vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method

vllm: 0.8.0 → 0.19.0

Keras archive extraction utilities allow path traversal and arbitrary file writes

Keras archive extraction utilities allow path traversal and arbitrary file writes

keras: before 3.14.0

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded f

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method splits the base64 data string on commas to extract individual JPEG frames without enforcing a frame count limit. An attacker can exploit this by crafting a single API request containing thousands of comma-separated base64-encoded JPEG frames in a data URL, causin

vllm: 0.8.0 → 0.19.0

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

vllm: before 0.22.0

awxkit has a path traversal vulnerability

awxkit has a path traversal vulnerability

awxkit: all versions

OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake

OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake

oslo-messaging: ≥ 1.0.0

stigmem-node's Postgres schema identifier handling required defensive quoting

stigmem-node's Postgres schema identifier handling required defensive quoting

stigmem-node: before 0.9.0a2

stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment

stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment

stigmem-node: before 0.9.0a2

stigmem-node's federation peer token timestamp validation may reject valid peer tokens

stigmem-node's federation peer token timestamp validation may reject valid peer tokens

stigmem-node: before 0.9.0a2

aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler

aiosend: before 3.0.7

Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`

Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`

jupyter-server: before 2.18.0

Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories

Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories

jupyter-server: before 2.18.0