Advisory Catalog

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS

pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

Sulu: Stored XSS via media download inline-disposition override

Sulu: Media move/update authorization bypass (IDOR)

Sulu: Fix authorization bypass when creating preview links

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Livewire DOM-based cross-site scripting during client-side state handling

Kirby: Access to image files outside of the site root via path traversal in the media handling

Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

qs array-limit bypass via bracket-key comma parsing

qs: Denial of Service via Attacker Controlled isBuffer

MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

silverstripe/versioned has XSS in archive admin restore

MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

AIIR verification and policy gates could report success without enforcing the control (fail-open)

morgan vulnerable to Log Forging via unescaped Unicode line separators

libreoffice-convert vulnerable to path traversal / arbitrary file write

NLTK: Downloader.download follows hardlinks and overwrites outside-root files

NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_c

openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/

In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main passwor

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting (XSS) vulnerability. *Note: This vulnerability was fixed in 8.x-2.1 but that

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers to

This module enables users to authenticate using LDAP or Active Directory credentials. The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to.

The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view.

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is mit

The [DXPR Builder](https://www.drupal.org/project/dxpr_builder) module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata. The 2.x version of the module does not sufficiently restrict access

This module enables you to disable access to the `/user/login` form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared

The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display. The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous vis

This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints. The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to en

This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view.

The Address Suggestion module provides address autocomplete functionality using configured address providers. The module doesn't sufficiently sanitize address suggestion data returned by configured providers, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitig

cakephp/debug_kit: MailPreview contains unsafe reflection

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successful exploit of this vulnerability might lead to information disclosure and data tampering.

eml_parser has parser DoS via deeply nested parentheses in e-mail headers

eml_parser has a URL extraction bypass via HTML entities in URLs