Advisory Catalog

Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Copyparty vulnerable to reflected XSS via setck parameter

pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps

mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute

Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name

Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Rucio WebUI has Username Enumeration via Login Error Message

LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function

Fickling has safety check bypass via REDUCE+BUILD opcode sequence

zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service

changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response

NiceGUI vulnerable to XSS via Code Injection during client-side element function execution

Apache Superset allows privileged users to conduct error-based SQL Injection

Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine

Apache Airflow exposes sensitive information in its log files

OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp

Isso affected by Stored XSS via comment website field

Apache Airflow error reporting may expose full kwargs

Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)

Werkzeug safe_join() allows Windows special device names

changedetection.io is vulnerable to unauthenticated static path traversal

pypdf possibly has long runtimes for malformed FlateDecode streams

pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

pypdf has a possible infinite loop when processing TreeObject

Indico Affected by Cross-Site-Scripting via material uploads

Indico has Server-Side Request Forgery (SSRF) in multiple places

sqlparse: formatting list of tuples leads to denial of service

DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different usernames to the password reset endpoint and distinguish between existing and non-existing accounts by analyzin

LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection

Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)

Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns

Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users

Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access

MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability

MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access

NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

web2py has an Open Redirect Vulnerability

Wagtail has improper permission handling on admin preview endpoints

Django has an SQL Injection issue

Django has Observable Timing Discrepancy

Tendenci CMS contains a stored Cross-site Scripting (XSS) vulnerability in the Forums module

Tendenci CMS Contains a Cross-site Scripting Vulnerability in its Jobs Module

picklescan vulnerable to arbitrary file create using logging.FileHandler

llama-index-core vulnerable to Uncontrolled Resource Consumption

OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicious payload in the query string, leading to execution of JavaScript in the victim's browser. For exam

Tendenci is Vulnerable to CSV Formula Injection through its Contact Form Message Field

TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)