LiteLLM: Authenticated command execution via MCP stdio test endpoints

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication

Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization

Gnutls: gnutls: authentication bypass via nul character in username

Missing Authentication for Critical Function in mlflow/mlflow

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Gnutls: gnutls: denial of service via dtls zero-length fragment

Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles

Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole

Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation

Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod

Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components

JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

protobufjs: Code injection through bytes field defaults in generated toObject code

jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wide

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override

Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge