Advisory Catalog

xmldom: Quadratic-memory consumption

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

xmldom: Quadratic-time attribute deduplication

xmldom: HTML raw-text closing-tag case mismatch causes output amplification

xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom: Element name injection via createElement() bypasses requireWellFormed

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Hugging Face Transformers downloads custom generation code before trust consent

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

EasyAdmin custom-action dispatcher bypasses access_control on other routes

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

Kirby: File upload permissions are not checked during processing of chunk data

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

multer vulnerable to Denial of Service via oversized array index in field names

multer vulnerable to Denial of Service via crafted multipart field names

multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

WsgiDAV MySQL provider has a blind SQL injection

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

mongodb: Reject "." and NUL bytes in database and collection names

NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots

NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaus

openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READ_FILES permission could read or write another plugin's directory that merely sh

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster

openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false i

openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserv

openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O_NOFOLLOW on t

openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offlin

openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files.

openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system acces

silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template

silverstripe/userforms vulnerable to remote code execution via userforms email subject

Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project

LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions