Pinned Loading

1. mcp-imagemagick-rce mcp-imagemagick-rce Public

   OS command injection (CWE-78) in Yoshino-Yukitaro/imagemagick_mcp_server — advisory, detection and PoC. Repository archived upstream; no fix possible.

   JavaScript

2. poc-cve-2026-111497 poc-cve-2026-111497 Public

   CVE-2026-111497 (Node2Shell): deteccion del decoder Brotli vulnerable en Python y Node por el codigo de error real del decoder, con laboratorio HTTP local

   Python

3. llamacpp-gguf-zero-dim-sigfpe llamacpp-gguf-zero-dim-sigfpe Public

   llama.cpp/ggml GGUF loader divides INT64_MAX by a file-supplied tensor dimension that may be zero: 53-byte file crashes x86-64 builds (SIGFPE). Fixed in b10398.

   Python

4. ollama-agent-cwd-prefix-bypass ollama-agent-cwd-prefix-bypass Public

   ollama experimental agent: isCommandOutsideCwd uses strings.HasPrefix without a path separator, so the out-of-project approval warning is skipped for sibling directories. Fixed by removal.

   Go

5. onnx-tensorrt-int4-oob-write onnx-tensorrt-int4-oob-write Public

   Heap out-of-bounds write in onnx-tensorrt WeightsContext::convertPackedInt32Data via INT4/FP4 initializer (shape vs int32_data size). Fixed in release/11.0-GA.

   Python

6. samsung-one-circle-offset-overflow samsung-one-circle-offset-overflow Public

   Samsung ONE luci Circle importer: uint64 overflow in the extended-Buffer bounds check gives a controlled heap out-of-bounds read on model load. Unpatched in 1.30.1; upstream frozen.

   C++