Advisory Catalog

Traefik entrypoint header-name sanitization bypassed via request trailers

Traefik HTTP/3 Backend NTLM Connection Reuse

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone: http backend forwards custom/auth headers to a different host on redirect

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

rclone local: crafted Range request against a translated symlink panics (DoS)

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone: RC per-server auth-proxy bypass

rclone: FTP cross-session auth-proxy backend confusion

rclone: source object names can escape the configured root on upload

rclone: S3 multipart declared-length memory exhaustion

Traefik: ForwardAuth identity spoofing via dot-form header alias

Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded

Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation

Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification

Joker linter executed project-local .jokerd/linter.* files during linting

Komari: Management Interface CSRF

webhookd: Unrestricted HTTP Header to Shell Variable Injection

containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service

LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

LF Edge eKuiper: SSRF in External Service

LF Edge eKuiper: Self-XSS in External Service Creation

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

Infracost: Arbitrary file read via config-template readFile symlink traversal

Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher

Semaphore U: OS Command Injection

SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo

SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews

Snowflake drivers writes sensitive information to logs

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)