Advisory Catalog

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function

Nezha's authenticated agents can forge service-monitor results for other users' services

authentik's XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

golang.org/x/image/tiff has excessive resource consumption in PackBits decompression

Gotenberg has a Race Condition via Multipart `downloadFrom` Handling

Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename

GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands

Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives

Calico Inserts Sensitive Information into Log File

Casdoor doesn't enforce SAML assertion time bounds

OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

KubeVirt has a Link Following issue

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

picoclaw is vulnerable to OS command injection via the ExecTool component

Mattermost doesn't validate file ownership and access control

Mattermost doesn't enforce request body size limits on plugin HTTP endpoints

Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation

Arcane: Missing admin authorization on global variables endpoint

Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

containerd user ID handling bypass allows runAsNonRoot evasion

Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read

Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives

Apache Camel K: Kubernetes namespace authorized users can create a Build resource

Mattermost has a Path Traversal issue

Caddy Defender trusted proxy client IP bypass

FileBrowser Quantum: unauthenticated user share share info

Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

zrok copy writes attacker-controlled WebDAV paths outside the destination root

gohttp is vulnerable to directory traversal via a crafted request

Algernon: Single-file mode unconditionally enables debug mode

OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

Docker: Race condition in docker cp allows bind mount redirection to host path

Docker: `PUT /containers/{id}/archive` executes container binary on the host

TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

iskorotkov/avro: CPU Exhaustion in Decoder

iskorotkov/avro: Integer Overflow in Decoder

Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

iskorotkov/avro: Denial-of-Service Vulnerability in Decoder