Advisory Catalog

Vite: `server.fs.deny` bypassed with queries

Waline login accepts a non-string email as a match-all MongoDB query

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`

systeminformation has prototype pollution in `networkStats()` via the interface name

Seroval: Code injection through a typed array's own constructor property

Seroval: Script injection through RegExp sources in serialized output

Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

Backstage catalog rules can be bypassed for URL locations using encoded path segments

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Nuxt server islands render `useHeadSafe` input without sanitisation

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

Electron: openExternal permission requests can be attributed to the wrong origin

Electron: HID and USB permission checks can be attributed to the wrong origin

Electron: Pointer lock permission requests can be attributed to the wrong frame

Electron: SameSite cookie restrictions are not applied to windows opened from links

@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS: Cross-domain session token in URL confers session takeover

ApostropheCMS: CAPTCHA response token not URL-encoded

ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)

ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

ApostropheCMS: Import API bypasses publication roles for protected content

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

ApostropheCMS: Import archives can exhaust server storage and deny service