Advisory Catalog

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc

Sentry-Javascript: Middleware Bypass when using Tunnel route

Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

Django REST framework: TokenProxy.delete() reports success and revokes nothing

Django REST framework: JSONParser applies an attacker-named codec to the request stream

Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Nuxt server islands render `useHeadSafe` input without sanitisation

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

Astro: Arbitrary CSS injection in Astro View Transitions

Storybook dev server vulnerable to code injection from the local network

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds. When the input of the node creation form is processed, it makes use of PHP's unserialize function. This i

Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or not found response, or redirect the visitor to another URL. The module has two vulnerabilities. Rabbit Hole behavior can be skipped with a specific query parameter. In these cas

The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool. The module does not sufficiently check whether the current user is permitted to view a file

Data Field allows you to create custom fields with multiple values under the default table form. The `file_uri` formatter does not properly escape filenames when rendering links to uploaded files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to

This module enables you to restrict user logins on a multi-domain site built with the Domain module, so that users can only log in on the domains assigned to them. The module doesn't sufficiently enforce these restrictions when a user logs in by a method other than the standard login form. This vu

The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or non-public site cannot be viewed, crawled or indexed by anonymous visitors. The module doesn't sufficiently limit the number of authentication attempts it will evaluate under the sce

This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image style download controller to serve them. The module serves WebP image derivative responses with the HTTP header `Cache-Control: public` for all file schemes other than the private fi

TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than `private://`. This vulnerability is mitigated by the fact that Drupal must be

This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the HTTP header `Cache-Control: public` when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. This

This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerability which allows to update entity fields without checking field-level access. The vulnerability is mitigated by the fact that an attacker

This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user permission to create specific media types if the bulk upload form is configured for that media type. This vulnerability is mitigated by the fact that an attacker must have a role wi

This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. Since version 6.1.0, the module could cache a token's permissions in a way that let them be reused fo

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields. This vulnerability is mitigated by the fact that a

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery (CSRF). An attacker could trick an editor into visiting a crafted link, which

This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation. The module doesn't sufficiently check role delegation when approving users, and offers an Activate link for blocked administrators. It also doesn't protect user

This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type. The module doesn't suffici

Provides the Bootstrap front-end framework as a Drupal theme. Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site scripting vulnerability. This vulnerability is mitigated by only affecting the optional tooltip and popover features. A short-term mitigati

This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished translation, the module grants every user with the "access content" permission view access to the published translations of that node. This overrides the restrictions of other node acce

This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates do not sufficiently sanitize values passed to its markup. This vulnerability is mitigated by the fact that an attacker must have a role to edit content that uses the paragraph bund

Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events. This module provides a route for displaying published content entities in a dialog. The route does not sufficiently verify the current user's access to the specifi

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whose

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting (XSS) vuln

Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box. A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit. This vulnerability is mitiga