Browse CVEs by Ecosystem and Severity

PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory

LiteLLM: Authentication Bypass via Host Header Injection

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

Langflow: Unauthenticated RCE in Shareable Playgrounds

ChromaDB has a code injection vulnerability

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)

MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed

Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering

Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution

Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass

MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration

OpenMed vulnerable to remote code injection through privacy-filter model loading path

praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

rattler has an entry-point path traversal in noarch:python install (arbitrary file write)

Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine

praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}

praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset

PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset

stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback

amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection

Langroid has Prompt to SQL Injection, Leading to RCE

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

BoxLite: Permission Bypass Allows Modification of Read-Only Files

Apache Fory PyFory Deserialization of Untrusted Data

Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths

MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

ChromaDB Python project has a pre-authentication code injection vulnerability

SGLang: Unauthenticated RCE via --enable-custom-logit-processor

SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket

SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability

utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override

llm CLI tool contains a code injection vulnerability via `--functions` command-line argument

imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module

mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

Ludwig framework is vulnerable to insecure deserialization through its predict() method.