漏洞公告

Snorkel MultitaskClassifier.load uses an unsafe torch.load

Apache Tomcat - WebSocket authentication header exposure

Snorkel BaseLabeler.load uses an unsafe pickle.load

PySyft server-side arbitrary Python execution after code approval

Apache Tomcat - AJP secret compared in non-constant time

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

Snorkel Trainer.load uses an unsafe torch.load

PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

Apache Tomcat: LockOutRealm treats user names as case-sensitive

Apache Tomcat - Security constraints not correctly applied

Superduper: Remote code execution via unsafe eval in superduper query parsing

OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input

OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS

Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS

sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

protobuf.js: Code injection in pbjs static output from crafted schema names

protobuf.js: Denial of service from crafted field names in generated code

protobuf.js: Code injection through bytes field defaults in generated toObject code

protobuf.js: Prototype injection in generated message constructors