Browse CVEs by Ecosystem and Severity

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

djust has an authorization bypass on the WebSocket/SSE mount path

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

PyTorch Lightning path traversal vulnerability

GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

NLTK: Allowlisted pickle loaders still permit code execution in current source

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

unstructured: Server-Side Request Forgery in the URL-based partitioning

NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

plone.app.event vulnerable to denial of service via iCalendar import

plone.app.portlets vulnerable to denial of service via RSS feed portlet

LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

senaite.core Vulnerable to Eval Injection and Missing Authorization

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

surfio has an out-of-bounds read

resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)