Advisory Catalog

Mattermost doesn't validate file ownership and access control

Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions

Mattermost doesn't archive the channel before removing persistent notifications

Mattermost doesn't validate user-supplied input in API request handlers

Mattermost doesn't enforce request body size limits on plugin HTTP endpoints

Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation

Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory

Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members

Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

Arcane: Missing admin authorization on global variables endpoint

Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)

Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory

Go Net HTML parser is vulnerable to denial of service

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto doesn't enforce invoking key constraints

golang.org/x/crypto vulnerable to infinite loop on large channel writes

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

BoxLite: Permission Bypass Allows Modification of Read-Only Files

containerd user ID handling bypass allows runAsNonRoot evasion

SpiceDB: Caveat structures with nested lists can result in improper cache reuse

Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables

Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read

Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger

Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives

androidqf: APK download Path Traversal in device APK paths

androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers)

Klever-Go KVM read-only execution can commit contract delete and upgrade side effects

Apache Camel K: Kubernetes namespace authorized users can create a Build resource

Mattermost has a Path Traversal issue

Mattermost has an Incorrect Authorization issue

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS