| ID | Severity | Title | AI Score | Found | Status |
|---|---|---|---|---|---|
| ZDS-2025-0142 | CRITICAL9.8 | Prototype pollution via crafted JSON chunk EPSS 96%POC NOKEVEXPLOITED NOW | 97 | 12h ago | DISCLOSED |
| ZDS-2025-0141 | HIGH8.4 | Pickle deserialization backdoor in tokenizer.bin EPSS 80%POC NONO-KEVNOT EXPLOITED | 95 | 1d ago | DISCLOSED |
| ZDS-2025-0140 | HIGH7.8 | World-writable /var/run permits LPE in sidecar pattern EPSS 66%POC NOKEVNOT EXPLOITED | 82 | 3d ago | PATCHED |
| ZDS-2025-0139 | CRITICAL9.4 | Path traversal in tool/read_file allows host FS read EPSS 91%POC NOKEVEXPLOITED NOW | 96 | 4d ago | DISCLOSED |
| ZDS-2025-0138 | MEDIUM6.3 | Typo-squat shipping postinstall miner EPSS 57%POC NONO-KEVNOT EXPLOITED | 88 | 6d ago | DISCLOSED |
| ZDS-2025-0137 | HIGH7.4 | Prompt-injectable cookie exfiltration EPSS 67%POC NONO-KEVNOT EXPLOITED | 89 | 8d ago | EMBARGOED |
| ZDS-2025-0136 | MEDIUM6.1 | Embedded Lambda layer phones home with prompts EPSS 51%POC NONO-KEVNOT EXPLOITED | 81 | 10d ago | DISCLOSED |
| ZDS-2025-0135 | LOW3.7 | Default entrypoint logs PG password to stdout on retry EPSS 27%POC NONO-KEVNOT EXPLOITED | 69 | 12d ago | PATCHED |
| ZDS-2025-0133 | HIGH8.1 | JWT 'none' algorithm accepted under fallback path EPSS 63%POC NONO-KEVNOT EXPLOITED | 74 | 15d ago | PATCHED |
| ZDS-2025-0131 | HIGH8.0 | Zip-slip path traversal during extraction EPSS 74%POC NOKEVNOT EXPLOITED | 91 | 19d ago | DISCLOSED |
| ZDS-2025-0129 | CRITICAL9.6 | Embedded SSH key in /root/.ssh grants pull-time backdoor EPSS 91%POC NONO-KEVEXPLOITED NOW | 94 | 23d ago | DISCLOSED |
| ZDS-2025-0128 | CRITICAL9.9 | Unbounded shell tool with no allowlist EPSS 92%POC NONO-KEVEXPLOITED NOW | 92 | 26d ago | DISCLOSED |
| ZDS-2025-0127 | MEDIUM6.8 | Custom code in modeling_*.py auto-executed on trust_remote_code EPSS 55%POC NONO-KEVNOT EXPLOITED | 78 | 27d ago | DISCLOSED |