Advisory Catalog

DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

Widget Factory Joomla Content Editor Improper Access Control Vulnerability

MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

Supply chain compromise via malicious @cap-js/openapi

WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

Progress LoadMaster Command Injection Vulnerability

OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed

Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering

Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution

Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass

This module configures default editorial workflows for LocalGov Drupal content types. It provides a Drupal content moderation workflow, a content approvals dashboard, content scheduling and content preview. The module doesn't sufficiently restrict access to a view of Service Contacts at which expos

huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration

OpenMed vulnerable to remote code injection through privacy-filter model loading path

praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

When Vitest UI server is listening, arbitrary file can be read and executed

Apache Airflow vulnerable to Improper Neutralization of Special Elements Used in a Template Engine

praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}

praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset

PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset

stigmem-node's federation peer registration lacked explicit out-of-band approval

stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation

stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback

Shopper: Authorization bypass and RBAC privilege escalation in team settings

NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass

vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE

vm2 is Vulnerable to Sandbox Breakout Through Promise Species

vm2 has a Sandbox Escape issue

OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

Mautic vulnerable to Path Traversal via Campaign Import

Mautic has Server-Side Template Injection (SSTI) in Theme Templates

Oracle E-Business Suite Improper Privilege Management Vulnerability

Langroid has Prompt to SQL Injection, Leading to RCE

The Basket module enables e-commerce and checkout functionality for Drupal sites. The module does not sufficiently sanitize user-supplied data before passing it to PHP's unserialize(). An attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the

LiquidJS is Vulnerable to Remote Code Execution

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Nx Console Embedded Malicious Code Vulnerability

Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled

Dolibarr ERP CRM contains a remote code evaluation vulnerability

YesWiki: Unauthenticated SQL Injection

shell-quote quote() does not escape newlines in object .op values

Ubiquiti UniFi OS Improper Input Validation Vulnerability