Advisory Catalog

Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API

Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs

Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation

Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands

Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication

Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution

Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin

Casdoor has an authentication bypass

Casdoor does not validate the AudienceRestriction element in SAML assertions

Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check

Casdoor doesn't verify that a JWT used for token exchange is still active

Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest

MCP Toolbox for Databases vulnerable to DNS rebinding attacks

KubeVirt has a Link Following vulnerability

Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto doesn't enforce invoking key constraints

golang.org/x/crypto vulnerable to infinite loop on large channel writes

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

BoxLite: Permission Bypass Allows Modification of Read-Only Files

Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

Kopia: RCE via SSH ProxyCommand Injection

Algernon: handler.lua discovery walks parent directories above the server root

Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

Crabbox: environment variable exposure vulnerability

Portainer has an endpoint security bypass via Swarm service create/update

Portainer missing authorization on Docker plugin endpoints, which allows host RCE

SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions

free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction