LiteLLM: Authenticated command execution via MCP stdio test endpoints

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

Odh-dashboard: odh dashboard kubernetes service account exposure

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

protobufjs has an arbitrary code execution issue

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

lodash vulnerable to Code Injection via `_.template` imports key names

(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.

Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

LiteLLM has an authentication bypass via OIDC userinfo cache key collision

Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles

Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole

Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation

Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI

LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint

vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wide

Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization

Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

Safe Mode Bypass in keras-team/keras

Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication

Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener

Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials

Python-Multipart: Denial of Service via unbounded multipart part headers

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Pillow is vulnerable to a FITS GZIP decompression bomb

Go JOSE affect by a panic in JWE decryption

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

ReDoS in multipart 1.3.0 - `parse_options_header()`

Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data