Advisory Catalog

Picomatch has a ReDoS vulnerability via extglob quantifiers

n8n Has External Secrets Authorization Bypass in Credential Saving

n8n has SQL Injection in Data Table Node via orderByColumn Expression

n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover

n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition

Seafile Server has multiple stored XSS vulnerabilities

LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern

LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash

@grackle-ai/server has Missing WebSocket Origin Header Validation

@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool

n8n has In-Process Memory Disclosure in its Task Runner

Parse Server exposes auth data via /users/me endpoint

Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands

Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter

Parse Server: Denial of Service via unindexed database query for unconfigured auth providers

fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing

H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service

jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass

jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction

jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic

jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

Parse Server LiveQuery subscription query depth bypass

Parse Server has a query condition depth bypass via pre-validation transform pipeline

h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`

Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings

Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.

PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS

Parse Server's LiveQuery bypasses CLP pointer permission enforcement

SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()

Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC

oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

Qwik City has array method pollution in FormData processing allows type confusion and DoS

Parse Server has an auth provider validation bypass on login via partial authData

Prototype Pollution via parse() in NodeJS flatted

Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

Parse Server leaks protected fields via LiveQuery afterEvent trigger

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

socket.io allows an unbounded number of binary attachments

OneUptime WhatsApp Webhook Missing Signature Verification

OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read

Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)

SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

music-metadata has an infinite loop vulnerability in ASF parser

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Nest Fastify HEAD Request Middleware Bypass

Parse Server LiveQuery subscription with invalid regular expression crashes server

Parse Server's Cloud function dispatch crashes server via prototype chain traversal