Advisory Catalog

Quadratic complexity in WordDecoder.DecodeHeader in mime

Arbitrary inputs are included in errors without any escaping in net/textproto

Nezha's authenticated agents can forge service-monitor results for other users' services

Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints

GoClaw has a Command Injection issue

Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host

Authelia Missing Username Canonicalization in Basic Auth (LDAP)

authentik's XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

go-git: Malformed Git object data may cause panics or resource exhaustion

golang.org/x/image/tiff has excessive resource consumption in PackBits decompression

CAPM3 vulnerable to Cross-Namespace resource access

IPAM controller service account granted unnecessary full access to Secrets

Ironic Standalone Operator's controller modifies user-owned resources without consent

Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces

Panic when reading out of bound palette index in golang.org/x/image/bmp

Gotenberg has a Race Condition via Multipart `downloadFrom` Handling

Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename

GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands

Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives

OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

Calico Inserts Sensitive Information into Log File

Calico Inserts Sensitive Information into Log File

Casdoor has an authentication bypass

Casdoor allows users to bypass configured MFA requirements

Casdoor does not validate the AudienceRestriction element in SAML assertions

Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check

Casdoor doesn't enforce SAML assertion time bounds

Casdoor doesn't verify that a JWT used for token exchange is still active

Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest

Calico Inserts Sensitive Information into Log File

OpenBao's Inline Auth Incorrectly Redacted Headers

OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

opentelemetry-go's Schema ParseFile leaks file descriptors on each parse

opentelemetry-go's baggage parsing no longer caps raw header length

Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

Capsule Namespace Hijacking via subresource

KubeVirt has a Link Following issue

MCP Toolbox for Databases vulnerable to DNS rebinding attacks

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression

picoclaw is vulnerable to OS command injection via the ExecTool component

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

KubeVirt has a Link Following vulnerability

Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing

omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

Mattermost allows authenticated users to gain access to private repositories