Advisory Catalog

Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence

Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

CKEditor: Cross-site scripting (XSS) in the engine package

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Astro: Arbitrary CSS injection in Astro View Transitions

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

Electron: Frame subscription trusts GPU-supplied frame geometry

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

SvelteKit : XSS via untrusted cache-control header in prerendered page

SvelteKit: URL redirection to untrusted site via enhanced form submission

ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

ApostropheCMS: Path traversal in uploadfs

ApostropheCMS: Missing Authentication in `cleanExport` Route

Vite: Cross origin script execution through Vite custom middleware

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

fast-uri vulnerable to improper path equivalence in relative reference normalization

markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

msgpack5: Decoding negative int64 values mutates the input buffer

Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

i18next-http-backend incomplete URL validation permits SSRF

LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

Ghost: Server-Side Request Forgery in Webhook Trigger

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Next.js has information disclosure in development server's Model Context Protocol endpoint

KaTeX: Existing prototype pollution can bypass trust restrictions

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

Unleash: CR-approval email renders user-controlled raw HTML

undici vulnerable to downstream response splitting via retry interceptor

SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor

joi: Prototype pollution via a `__proto__` language key in custom messages

joi: object().rename() with a template target can set the validated object's prototype

multer vulnerable to file size limit bypass via async fileFilter race condition

MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

CKAN MCP Server: Information disclosure via verbose error reflection

Hono: Proxy Helper does not remove response headers listed in the `Connection` header

Mermaid configuration APIs allow prototype pollution