Advisory Catalog

Apache Answer: AdminToken not invalidated after admin deactivation

OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion

Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API

Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs

Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation

Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands

Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication

Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution

Nezha's private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data

Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents

Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

Dex: Token-exchange endpoint is missing AllowedConnectors enforcement

Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerability

Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability

Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability

Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability

Apache Answer vulnerable to Cross-site Scripting

Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin

Weaviate has an Improper Authorization issue

grepai Uses a Broken or Risky Cryptographic Algorithm

grepai Uses a Broken or Risky Cryptographic Algorithm

songquanpeng one-api has an issue that results in business logic errors

Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt

klever-go: REST API slow-header connection exhaustion via Gin Engine.Run

klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS

Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS

Source controller: Improper path handling allows traversal

Klever-Go KVM: Hash-array amplification in P2P resolver request handling

Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token

AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle

OpenMeter: SQL injection through meter creation

milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery

Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets

Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed compressed batches (DoS)

Singluarity: Incorrect path matching for 'limit container paths' directive

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function

ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader

Inefficient candidate hostname parsing in crypto/x509