Advisory Catalog

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

moment vulnerable to Path Traversal via crafted non-string locale name

October CMS: Incomplete Scheme Validation in Image Resizer

multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

joi messages compilation allows prototype replacement through __proto__ error codes

Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

Shopping privilege escalation through missing authorization in Settings components

Shopper: Negative discount values accepted and propagated through order calculation pipeline

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

weasyprint Has Server-Side Request Forgery (SSRF)

SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file. The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous user

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise rest

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenced

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module uses cryptographic constructions that do not align with current security best practices. The module performs certain signature compar

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorange\_saml module does not sufficiently validate certain user-supplied URLs before performing redirects. An attacker could cause users

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly validate TLS certificates when making outbound HTTPS requests. An attacker in a position to intercept network traff

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorange\_saml module does not correctly restrict access to certain functionality intended for administrative use. This could allow unautho

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability (XSS). This vulnerability is mitig

This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must ha

The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting (XSS) vulnerability.

This module enables you to turn a Drupal install into the Central Authentication System (CAS) Server. It makes your database the primary location for other systems to use for authentication in a SSO environment. The module doesn't sufficiently check the service URL used to redirect the user during

**Update 2026-09-11:** Increased risk score to reflect publicly documented methods for developing exploits. This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search. The module doesn't sufficiently sanitize

n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints

n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions

n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers