Advisory Catalog

AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`

Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

BillaBear is Vulnerable to SQL Injection in the EventRepository

TYPO3 SQL Injection in extension "Address List" (tt_address)

TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)

georgringer/news has SQL Injection in extension "News system" (news)

TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)

TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer

TYPO3 ke_search path traversal from arbitrary table configuration input

TYPO3 ke_search XML External Entity Injection

TYPO3 sf_register extension allows unauthorized assignment of frontend user groups

AVideo: Authenticated Arbitrary File Read in view/update.php

Sulu: Used API Keys may be available via Admin API

Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

Formie: Pre-authenticated server-side template injection in Hidden fields

shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption

shopper/framework: Authorization bypass in multiple Livewire admin components

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule

Statamic CMS: Server-Side Request Forgery via Glide

AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`

AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`

AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA

AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin

SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion

Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint

Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option

NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

SimpleSAMLphp casserver: Open Redirect in logout

CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration

MantisBT Vulnerable to Stored XSS in File Download

MantisBT has Stored XSS on Move Attachments Admin Page

MantisBT has a Private Bugnote Attachment Content Leak via REST API

MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API

MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field

MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column

MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

MantisBT has a Content Security Policy bypass via attachments

MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference

MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values

Yii 2: Local file inclusion via view parameter name collision

MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked

MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API

MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue

MantisBT has an authorization bypass in private issue monitoring

MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form