Advisory Catalog

Symfony allows changing the environment through a query

Access control vulnerable to user data deletion by anonynmous users

Path traversal in oak allows transfer of hidden files within the served root directory

Ollama Out-of-bounds Read

Hashicorp Vault vulnerable to denial of service through memory exhaustion

Laravel Reverb Missing API Signature Verification

lilconfig Code Injection vulnerability

Hashicorp Consul Path Traversal vulnerability

Kyverno's PolicyException objects can be created in any namespace by default

Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240628 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process each character, rendering ChuanhuChatGPT ina

An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. An attacker can read any file that matches specific criteria using an absolute path. The file must not have a .json extension and, except for

Plenti arbitrary file write vulnerability

Plenti arbitrary file deletion vulnerability

Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block

CycloneDX cdxgen may execute code contained within build-related files

useragent Regular Expression Denial of Service vulnerability

nope-validator Regular Expression Denial of Service vulnerability

validate.js Regular Expression Denial of Service vulnerability

Knwl.js Regular Expression Denial of Service vulnerability

CommonRegexJS Regular Expression Denial of Service vulnerability

Foundation Regular Expression Denial of Service vulnerability

insane vulnerable to Regular Expression Denial of Service

pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

SQL injection in funadmin

SQL injection in funadmin

Logic flaw in Funadmin

SQL injection in funadmin

SQL injection in funadmin

SQL injection in funadmin

SQL injection in funadmin

SQL injection in funadmin

SQL injection in funadmin

Exposure of vSphere's CPI and CSI credentials in Rancher

User Registration Bypass in Zitadel

Autolab Misconfigured Reset Password Permissions

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

OS Command Injection in Snyk gradle plugin

OS Command Injection in Snyk php plugin

Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify

curl_cffi bundles a version of libcurl affected by High Severity vulnerability

Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section

secp256k1-node allows private key extraction over ECDH

SQL injection in funadmin

Denial of service in http-proxy-middleware

Permissive Regular Expression in tacquito

MySQL Connector/Python connector takeover vulnerability

Starlette Denial of service (DoS) via multipart/form-data

Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room

Matrix JavaScript SDK's key history sharing could share keys to malicious devices