Advisory Catalog

Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py

Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files

Gradio performs a non-constant-time comparison when comparing hashes

Gradio has several components with post-process steps allow arbitrary file leaks

Gradio vulnerable to SSRF in the path parameter of /queue/join

Gradio has a one-level read path traversal in `/custom_component`

Gradio's CORS origin validation accepts the null origin

Gradio's `is_in_or_equal` function may be bypassed

Alist reflected Cross-Site Scripting vulnerability

Authd allows attacker-controlled usernames to yield controllable UIDs

Magento Open Source Improper Access Control vulnerability

Magento Open Source Information Exposure vulnerability

Magento Open Source Information Exposure vulnerability

Magento Open Source Improper Authorization vulnerability

Magento Open Source Improper Access Control vulnerability

Magento Open Source Improper Access Control vulnerability

Magento Open Source Improper Authorization vulnerability

Magento Open Source stored Cross-Site Scripting (XSS) vulnerability

Magento Open Source Incorrect Authorization vulnerability

Magento Open Source Improper Access Control vulnerability

Magento Open Source reflected Cross-Site Scripting (XSS) vulnerability

Magento Open Source Improper Access Control vulnerability

Magento Open Source Improper Access Control vulnerability

Magento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

Magento Open Source Server-Side Request Forgery (SSRF) vulnerability

open-webui allows writing and deleting arbitrary files

open-webui Insecure Direct Object Reference (IDOR) vulnerability

Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or prior. The runtime c

This module enables you to to easily create and manage faceted search interfaces. The module doesn't sufficiently filter for malicious script leading to a reflected cross site scripting (XSS) vulnerability. The vulnerability exists in the Facets Summary submodule. If you do not use that sub module

Buildah allows arbitrary directory mount

Denial of Service in TYPO3 Bookmark Toolbar

Directus inserts access token from query string into logs

Django allows enumeration of user e-mail addresses

Information Disclosure in TYPO3 Page Tree

ggit is vulnerable to Arbitrary Argument Injection via the clone() API

SAP HANA Node.js client package vulnerable to Prototype Pollution

Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name

LimeSurvey Cross Site Scripting vulnerability

LimeSurvey Cross Site Scripting vulnerability

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page

Lara-zeus Dynamic Dashboard and Artemis do not validate paragraph widget values which can be used for XSS

PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file

Mediawiki Cargo extension vulnerable to Cross-site Scripting

Improper permissions handling in MediaWiki AbuseFilter

cookie accepts cookie name, path, and domain with out of bounds characters

OpenStack Ironic fails to verify checksums of supplied image_source URLs

Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS

@saltcorn/server arbitrary file and directory listing when accessing build mobile app results

@saltcorn/server arbitrary file zip read and download when downloading auto backups