GHSA-HRMJ-7RVJ-4HG8 lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

PT-2026-96823

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description The LightRAG API server returns raw Python exception text in HTTP error responses across multiple routers, including document routes.py, graph routes.py, query routes.py, ollama api.py, and lightrag...

vLLM DOS: Remotely kill vllm over http with invalid JSON schema

Summary Hitting the /v1/completions API with a invalid jsonschema as a Guided Param will kill the vllm server Details The following API call venv derekh@ip-172-31-15-108 $ curl -s http://localhost:8000/v1/completions -H "Content-Type: application/json" -d '"model":...

CVE-2015-5216: Improper Neutralization of Input During Web Page Generation

The Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message template, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via an HTTP response...

PT-2020-7857 · Ipsilon · Ipsilon

Name of the Vulnerable Software and Affected Versions: Ipsilon versions 0.1.0 through 1.0.0 Description: The issue arises from the Identity Provider IdP server not properly escaping certain characters in a Python exception-message template. This makes it easier for remote attackers to conduct...