Bugs found, fixes shared.
Argo helps me look for security bugs in open-source code. I review the results and report them upstream. Here’s what became public.
- Projects
- 27
- Public PRs
- 66
- Published advisories
- 24
- Resolved records
- 85
- CVEs listed
- 10
Where things stand
96public records
- Resolved
- Open
- Unpatched
- Other closed
By severity
Projects with most records
Across all 96 public records. Select a severity or project to explore. GitHub's Moderate advisories are grouped under Medium.
Explore the findings
Every record leads to a public pull request or advisory.
96 records across 27 projects
Open WebUIPython~153.4KSelf-hosted AI interface for LLMs and tools.
VaultwardenRust~68.5KSelf-hosted, Bitwarden-compatible password manager server.
- GHSA Cross-organization group assignment could grant full access to another organization’s ciphers — fixed in 1.37.0 Advisory - fixed
- GHSA Read-only collection members could inject ciphers through organization import — fixed in 1.37.0 Advisory - fixed
- GHSA Second-stage favicon IP literals bypassed the icon endpoint’s SSRF filter — fixed in 1.37.0 Advisory - fixed
PocketBaseGo~60.7KOpen-source Go backend: SQLite database, auth and admin dashboard in one file.
GiteaGo~58.3KSelf-hosted Git service with collaboration, package, and CI features.
- GHSA An OAuth access token could be exchanged as a refresh token, extending access beyond its original lifetime (fixed in 28.1.0, reporter credited) Advisory - fixed
- GHSA Private-user social graph, key and starred-repository API routes bypassed the visibility check (fixed in 1.27.3, reporter credited) Advisory - fixed
mitmproxyPython~45.2KInteractive TLS-capable HTTP proxy for debugging, testing and security analysis.
ntfyGo~33.6KSimple HTTP-based pub-sub notification service — send push notifications via a plain PUT/POST, no app-specific setup.
authentikPython~25.4KA self-hosted identity provider (SSO) implementing SAML, OAuth2/OIDC, LDAP and SCIM.
- GHSA A SAML Source accepted an assertion an IdP had issued for a different service provider, and accepted the same assertion more than once, allowing an authentication bypass (fixed in 2026.2.7 / 2026.5.7 / 2026.8.2, reporter credited) Advisory · fixed
- GHSA Several credential-bearing configurations returned their stored secrets over the API to anyone holding view permission alone (fixed in 2026.2.7 / 2026.5.7 / 2026.8.2, reporter credited) Advisory · fixed
ds4C~21.4KA compact C engine for running DeepSeek-class LLMs with an agent / tool loop.
- Fork PR #1 Unlink the bash-tool output temp file on job cleanup (antirez/ds4#540 itself is still open upstream; adopted with authorship preserved into the community fork elkaix/ds4) Merged in fork
- Issue #549 Follow-up hardening / design items from a security review Issue
LiveKitGo~20.3KOpen-source, self-hostable WebRTC infrastructure (SFU) for real-time audio, video, and data.
- PR #4782 MigrationDataCache buffered an unbounded number and size of reliable data packets during the 2-second migration window; now capped at 4 MiB with excess dropped Fixed independently
- PR #4741 Data-track packet header parser allowed hdrSize to exceed buffer length, crashing the whole server process on a single malformed message from any joined participant Fixed independently
- PR #4741 Integer wraparound in the same data-track header parser could also cause an out-of-bounds slice read/panic for large extension-size values Fixed independently
- PR #4739 Unclamped Dependency-Descriptor spatial/temporal IDs could index a fixed array out of bounds and crash the process Fixed independently
- PR #4757 Unauthenticated, oversized Twirp request bodies were fully decoded before any bridge-grant check ran Fixed independently
- PR #4743 No maximum read-message size was configured on the client-facing signaling WebSocket, allowing unbounded memory growth from a single connection Fixed independently
- PR #4750 Per-participant pendingTracks map grew without bound; a connection could add tracks without publishing them to exhaust server memory Fixed independently
- PR #4742 Malformed TURN deny_peer_cidrs entries silently disabled the intended deny rule instead of failing closed Fixed independently
- PR #4744 A single participant credential could open unlimited TURN relay allocations, exhausting the shared relay-port range for everyone else Fixed independently
- PR #4758 DownTrack.handleRTCP spawned one goroutine per incoming RTCP NACK packet with no cap, letting a peer exhaust server resources Fixed independently
- PR #4756 Authentication failures logged and reflected raw bearer tokens and API-key identifiers back to the caller Fixed independently
- PR #4749 A partially configured Prometheus Basic Auth (only username or only password set) silently left the metrics endpoint fully unauthenticated Fixed independently
- PR #4742 Whitespace-only external TURN secret files silently disabled dynamic credential validation Fixed independently
- PR #4742 TURN TTL configuration accepted negative values and overflowing duration conversions Fixed independently
FreshRSSPHP~16.1KSelf-hosted RSS / Atom feed aggregator.
- PR #9336 Disabled accounts kept token access (RSS/OPML export, feed refresh) — token validation now requires the account be enabled Merged
- PR #9335 Privileged self-updater mutations were accepted via GET without CSRF; now require POST + token, and the post-config step is bound to a one-time marker Merged into edge
- PR #9333 Session ID not rotated on remember-me restore, HTTP auth or self-registration auto-login (session fixation) Merged into edge
- PR #9334 One-time login challenge nonce stayed reusable and survived logout — now consumed on use (single-use) Merged into edge
- PR #9337 Remote responses buffered and decompressed with no byte limit — response body and headers now capped (decompression bomb / memory exhaustion) Open
- PR #9332 ZIP import expanded an unlimited number and total size of members — now bounded (decompression bomb) Merged into edge
Apache AnswerGo~15.6KSelf-hosted Q&A and knowledge community platform.
coturnC~14.3KA widely-deployed TURN and STUN relay server for WebRTC NAT traversal.
- GHSA addr_less_eq() compares IPv6 range endpoints byte-by-byte instead of numerically, letting an authenticated TURN client bypass denied-peer-ip / allowed-peer-ip IPv6 ranges (a TURN-specific SSRF) Advisory · fixed
- GHSA An authenticated client can grow the shared multiplex-peer demux table without limit in multiplex-peer mode Advisory · fixed
PHP-CS-FixerPHP~13.6KThe PHP Coding Standards Fixer.
- PR #9852 Cache file and directory were created world-writable regardless of umask — a co-located local user could forge a cache entry to bypass the style gate Merged
- PR #9856 Refuse a symlinked cache path before it can redirect a cache write outside its intended location Merged
- PR #9855 Reject wrong-typed cache data so a corrupt cache is rebuilt instead of crashing the process Merged
ProxySQLC++~6.9KHigh-performance proxy for MySQL and PostgreSQL traffic.
- GHSA-qg2m-q3ch-cg9v Truncated compressed MySQL packet tail can abort the process; NDEBUG builds also read out of bounds Advisory · unpatched
- GHSA-5cf5-7gfq-rrj6 Short COM_STMT_EXECUTE packet triggers an out-of-bounds statement-ID read Advisory · unpatched
- GHSA-x23w-3v26-vgvj Unbounded length-encoded integer parsing permits a pre-authentication out-of-bounds read Advisory · unpatched
- GHSA-r23x-jg5r-jmcc Oversized COM_STMT_EXECUTE bind value causes an out-of-bounds read forwarded to the backend Advisory · unpatched
- GHSA-33xp-q4g3-r79r Unauthenticated PostgreSQL packet length can trigger an unbounded memory allocation Advisory · unpatched
halloyRust~4.4KA modern IRC client.
- PR #2149 Harden against three remote-DoS issues (reported via private advisory) Merged
- PR #2331 Bound the number of concurrently open IRCv3 batches from a server Merged
- PR #2366 Harden DCC filename sanitization against reserved names and illegal characters (includes #2329) Merged
- PR #2330 Guard server-icon decoding against oversized (decompression-bomb) images Merged
- PR #2332 Redact credentials from the IRC protocol log Open
open62541C~3.2KOpen-source C implementation of the OPC UA industrial communication stack.
- PR #8440 Out-of-bounds read/write and silent truncation in the PKCS#11 TPM AES-CTR PubSub en/decrypt — a block-aligned size stored in an 8-bit CK_BYTE wraps past 255 (fix into 1.3–1.4) Merged
- PR #8441 Same PKCS#11 TPM AES-CTR out-of-bounds read/write and truncation fix, forward-ported to the 1.5 branch Merged
- PR #8442 A malformed async MSG response made the client clear an uninitialized UA_Response on the decode-failure path (uninitialized read) Merged
- PR #8444 HMAC/MAC verification compared tags with a non-constant-time, early-exit memcmp (a remotely observable timing side channel); switched to a length-checked constant-time compare Merged
- PR #8447 Malicious OpenSecureChannel responses leaked decoded client-side heap on the nonce-reuse/error path — now freed (fix into 1.3) Merged
- PR #8448 Same OpenSecureChannel decoded-heap leak fix, forward-ported to the 1.4 branch Merged
- PR #8610 Session authentication tokens now use a cryptographically stronger random source, with additional bounds checks for PubSub field counts and RegisterServer handling Merged
- PR #8611 Session authentication tokens now use a cryptographically stronger random source, with session-limit and SKS access hardening Merged
- PR #8612 Session authentication tokens now use a cryptographically stronger random source, with session-limit and ECC secret-length hardening Merged
moquetteJava~2.5KA lightweight MQTT broker.
- GHSA Pattern-ACL wildcard injection lets an attacker widen per-tenant %c/%u ACL rules via clientId/username Advisory · fixed
- PR #959 Guard the periodic expiration task so one failing entity can't disable all expirations Merged
- PR #958 Reject a malformed $share subscription before parsing it Merged
- PR #957 Keep the session event loop alive when a command throws Merged
- PR #964 Namespace the H2 queue metadata map to prevent a client-id collision Merged
- PR #963 Guard pattern ACL substitution against a null username Merged
- PR #967 Fail closed (not open to PermitAll/AcceptAll) when a configured authorizator/authenticator class fails to load Merged
legbaRust~1.9KA fast, modern credential brute-forcer and password sprayer.
- PR #98 Two remote-triggerable panics (DoS) from untrusted input Merged
- PR #99 Bound two server-controlled allocations (Kerberos, AMQP) + Kerberos read timeout Merged
- PR #100 Cap the IRC banner read + add a read deadline Merged
- PR #101 Avoid a panic on a multi-byte UTF-8 SMTP reply line Merged
- PR #102 Add read/write timeouts to the RDP connection Merged
libcspC~677The CubeSat Space Protocol: a small network stack used on spacecraft and embedded systems.
RecuperaBitPython~624Reconstructs and recovers files from damaged NTFS file systems.
gguf-toolsC~357A C implementation of the GGUF model-file format used by llama.cpp / ggml.
- PR #31 Fix an out-of-bounds write in the Q4_0/Q4_1 dequantizer's second block loop Open · in review
- PR #32 Grow the split-mixtral tensor array instead of asserting (heap overflow on crafted models) Open · in review
- PR #33 Bound tensor data offset/size against the mapping in gguf_get_tensor Open · in review
No matching findings
Try another term or clear the filters.
This is a snapshot of the public archive. Open an upstream link for the latest discussion. Records include fixes, backports and advisories, so they are not a count of distinct vulnerabilities. Published advisories can still be unpatched.
A finding is a starting point.
Argo coordinates language models in a structured source-code review. Human review checks the result; the upstream record shows what happened next. These records show practical work, rather than a complete measurement of what the system can find or miss.
Only public findings are listed. Private disclosures stay off this site until they are public. Argo has reviewed code in more languages than this archive represents.
Luigi is credited on LiveKit’s Security Hall of Fame. That recognition belongs to a private disclosure; the LiveKit records here link to public fixes. The individual PRs do not name the reporter.
Help make it better.
Found a false positive, a missed bug, or a prompt worth improving? Reports and pull requests are welcome.