Advisory Catalog

go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth

Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover

Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

Rancher Extensions have arbitrary file access via path traversal

Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure

Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine

Gotenberg has arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes

Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes

Gotenberg has a Server-Side Request Forgery (SSRF) Issue

Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist

Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection

ShellHub has crash-DoS via field injection in filter and sort-by parameters

ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data

ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace

axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening

MediaMTX affected by CVE-2026-27143 due to vulnerable dependency

opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay

Kyverno policy-reporter-ui has XSS via Stored Property Values in PropertyCard Component

Daptin fuzzy search injects unvalidated column name into raw SQL

Hatchet affected by cross-tenant information disclosure in `listTasksByDAGIds`

kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection

Hugo's Node tool execution allows file system access outside the project directory

Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS

Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain

Velocidex Velociraptor has an Incorrect Authorization issue

QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0

DevSpace UI Server WebSocket CheckOrigin does not validate source

Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore

Nginx-UI Settings API Exposes Protected Secrets

Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover

Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

Velocidex Velociraptor has an off-by-one error

Velocidex Velociraptor has an authorization bypass vulnerability

authd: Primary group ID is incorrectly set to value of UID

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display

Kubewarden vulnerable to RBAC Reconnaissance via unchecked can_i host capability call

PocketBase vulnerable to account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade

Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled

DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)

Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback

Fiber vulnerable to XSS in AutoFormat Content Negotiation

MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint