Advisory Catalog

auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs

HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

HAXcms createSite SSRF Enables Arbitrary File Read

ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag

Summarize contains a path traversal vulnerability

Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration

n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

@tmlmobilidade/utils has prototype pollution in its setValueAtPath

parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names

brace-expansion: Large numeric range defeats documented `max` DoS protection

ngrok is Vulnerable to Command Injection

form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys

jsondiffpatch patch APIs are vulnerable to prototype pollution

Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL

Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation

@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files

ws: Uninitialized memory disclosure

smtp-server's command parser memory exhaustion denial-of-service

@ranfdev/deepobj has a Prototype Pollution vulnerability

DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool

Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order

Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution

Svelte devalue: DoS via sparse array deserialization

Apostrophe has stored XSS via javascript: URL in Image Widget Link

Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections

FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover

FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover

FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover

FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover

FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover

FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover

FlowiseAI: Vector Store No Permission Checks

n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints

n8n Has a Source Control Pull SQL Injection

dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport

FlowiseAI Vulnerable to Credential Data Leak

FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment

Flowise has an MCP Security Bypass that Enables RCE

FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment

FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment

FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name