Advisory Catalog

Ubiquiti UniFi OS Path Traversal Vulnerability

Ubiquiti UniFi OS Improper Access Control Vulnerability

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

BoxLite: Permission Bypass Allows Modification of Read-Only Files

Twig: PHP code injection via `{% use %}` template name

Concrete CMS Vulnerable to Relative Path Traversal

@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails

@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators

@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies

@hulumi/drift: Orphan reconciler accepted externally supplied execute plans

Apache Fory PyFory Deserialization of Untrusted Data

LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

Drupal Core has a SQL Injection issue

Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths

Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover

HAXcms: Private Key Disclosure via Broken HMAC Implementation

HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

Malware in @opensearch-project/opensearch

TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)

MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection

Malicious dropper in mistralai 2.4.6 PyPI package

Formie: Pre-authenticated server-side template injection in Hidden fields

ChromaDB Python project has a pre-authentication code injection vulnerability

SGLang: Unauthenticated RCE via --enable-custom-logit-processor

SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability

SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket

AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin

Daemon Tools Lite Embedded Malicious Code Vulnerability

utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation

Electerm Local code through electerm's single-instance socket

DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval

Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

n8n Has an XML Node Prototype Pollution Patch Bypass

n8n Has an Arbitrary File Read via Git Node

n8n: HTTP Request Node Pagination Prototype Pollution to RCE

FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

FlowiseAI Exposes Basic Auth Credentials via API

Strapi may leak sensitive data via relational filtering due to lack of query sanitization

Strapi Vulnerable to SQL Injection in Content Type Builder

vm2 Has a Sandbox Breakout Using Async Generator

This module enables you to export entity date fields as iCal feeds. The module doesn't sufficiently check entity or field access or sanitize user inputs when generating iCal feeds. This vulnerability is not mitigated by any permission, the routes are accessible to all anonymous users with no confi