Advisory Catalog

AstrBot Makes Use of Hard-coded Password

OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere

OpenStack Keystone has an Incorrect Authorization Issue

Sentry's improper authentication on SAML SSO process allows user identity linking

CKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`

Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

Weblate Doesn't Invalidate API Token on Password Change

Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider

django-mdeditor is Missing Authentication for Critical Function

CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`

pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider

mcpo-simple-server has a Path Traversal issue

CKAN has CSRF exemption primed by anonymous requests

CKAN has no certificate validation on STMP connection

beets has a Cross-site Scripting vulnerability