Advisory Catalog

Dcat Admin Cross-site Scripting (XSS) vulnerability

DrayTek Vigor Routers OS Command Injection Vulnerability

python-sql SQL injection vulnerability

OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access control for support information (http://<op

Marp Core allows XSS by improper neutralization of HTML sanitization

Koji Cross-site Scripting

Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx

Jinja has a sandbox breakout through indirect reference to format method

Jinja has a sandbox breakout through malicious filenames

uptime-kuma vulnerable to Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor

Browsershot Improper Input Validation vulnerability

Hashicorp Nomad Incorrect Privilege Assignment vulnerability

age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

Atro CSRF Middleware Bypass (security.checkOrigin)

Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo

PGHoard Path Traversal vulnerability

Traefik affected by CVE-2024-53259

Mattermost Race Condition vulnerability

Mattermost Improper Validation of Specified Type of Input vulnerability

Mattermost Data Amplification vulnerability

D-Tale allows Remote Code Execution through the Custom Filter Input

Browsershot Local File Inclusion

Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service

Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

Beego has Collision Hazards of MD5 in Cache Key Filenames

SiYuan has an SSTI via /api/template/renderSprig

kcp's impersonation allows access to global administrative groups

Open Social is a Drupal distribution for online communities, which ships with a default (optional) module social\_file\_private to ensure the images and files provided by the distribution are stored in the private instead of the public filesystem. For installations of Open Social prior to version 1

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page. The Login Disable module does not correctly prevent a user with a disabled login from logging in, allowing those users to by-pass t

pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion

CosmWasm VM Incorrect metering

Panic in wasmvm can slow down block production

Hugo does not escape some attributes in internal templates

Trix editor subject to XSS vulnerabilities on copy & paste

Apache Superset: Error verbosity exposes metadata in analytics databases

Predictable results in nanoid generation when given non-integer values

LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section

Directus has an HTML Injection in Comment

Firepad allows insecure document access

This module allows a site builder to create multi-step entity forms leveraging the Field Group field type plugins. The module doesn't escape plain text administrative configurations. An attacker with admin access could inject arbitrary JavaScript code. This vulnerability is mitigated by the fact t

The Minify JS module allows a site administrator to minify all javascript files that exist in the site's code base and use those minified files on the front end of the website. Several administrator routes are unprotected against Cross-Site Request Forgery (CRSF) attacks.

Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability

This module provides a field formatter for the field type 'file' called `Table of files with download all link` . The module had vulnerabilities allowing a user to download files they normally should not be able to download.

Module to restrict access from anonymous and regular users to configured pre-defined pages. The module does not adequately handle protecting certain types of URLs.

This module enables you to authenticate users through an Identity Provider (IdP) or OAuth Server, allowing them to log in to your Drupal site. The module does not sufficiently escape query parameters sent to the callback URL when displaying error messages, particularly if the code parameter is miss

Vitess allows HTML injection in /debug/querylogz & /debug/env

Synapse Matrix has a partial room state leak via Sliding Sync

Synapse's unauthenticated writes to the media repository allow planting of problematic content

Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality