Advisory Catalog

Capsule tenant owner with "patch namespace" permission can hijack system namespaces

LF Edge eKuiper has a SQL Injection in sqlKvStore

Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

gettext.js has a Cross-site Scripting injection

Persistent Cross-site Scripting in eZ Platform Rich Text Field Type

Persistent Cross-site Scripting in Ibexa RichText Field Type

webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle

Magento Stored Cross-Site Scripting (XSS) vulnerability

Magento OS Command ('OS Command Injection') vulnerability

Magento OS Command ('OS Command Injection') vulnerability

Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Magento Path Traversal vulnerability

Magento does not properly restrict excessive authentication attempts

Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability

Microsoft Project Remote Code Execution Vulnerability

Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability

Microsoft Windows Kernel Privilege Escalation Vulnerability

Mitel SIP Phones Argument Injection Vulnerability

Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint

TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability

Server-Side Request Forgery in axios

OpenFGA Authorization Bypass

Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow

Shopware vulnerable to Server Side Template Injection in Twig using Context functions

JupyterHub has a privilege escalation vulnerability with the `admin:users` scope

The Opigno Learning Path module enables you to manage group content. Administrative forms allow uploading malicious files which may contain arbitrary code (RCE) or cross site scriptiong (XSS). These forms were not adequately controlled with permissions that communicate the severity of the permissio

Pulp incorrectly assigns RBAC permissions in tasks that create objects

Django memory consumption vulnerability

Django vulnerable to a denial-of-service attack

Django vulnerable to denial-of-service attack

gotortc vulnerable to Cross-Site Request Forgery

Meshery SQL Injection vulnerability

RobotsAndPencils go-saml authentication bypass vulnerability

Owncast Cross-Site Request Forgery vulnerability

Nuxt Icon affected by a Server-Side Request Forgery (SSRF)

Nuxt Devtools has a Path Traversal: '../filedir'

Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm

Kubean vulnerable to cluster-level privilege escalation

Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability

Podman vulnerable to memory-based denial of service

soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests

NetBird uses a static initialization vector (IV)

cortex establishes TLS connections with `InsecureSkipVerify` set to `true`

Mattermost allows remote actor to create/update/delete posts in arbitrary channels

Beego privilege escalation vulnerability

Beego privilege escalation vulnerability

Filestash configured to skip TLS certificate verification when using the FTPS protocol

Filestash skips TLS certificate verification process when sending out email verification codes

Harbor fails to validate the user permissions when updating project configurations