LiteLLM: Authenticated command execution via MCP stdio test endpoints

Netty has Insufficient Bailiwick Validation for NS Records

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

Odh-dashboard: odh dashboard kubernetes service account exposure

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader

protobufjs has an arbitrary code execution issue

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

lodash vulnerable to Code Injection via `_.template` imports key names

(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

SSRF Protection Bypass in vLLM

Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

vLLM: OpenAI auth bypass

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Netty: HttpClientCodec response desynchronization

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

LiteLLM has an authentication bypass via OIDC userinfo cache key collision

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles

Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation

Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint

vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wide

Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Path Traversal in keras-team/keras

Llama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicy

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

Safe Mode Bypass in keras-team/keras

Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication

Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening

Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener

Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials

Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug default

NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

undici WebSocket client vulnerable to denial of service via fragment count bypass