Advisory Catalog

Account Takeover via Session Fixation in Zitadel [Bypassing MFA]

raspap-webgui vulnerable to denial of service

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

kubevirt-csi: PersistentVolume allows access to HCP's root node

Grafana's users with permissions to create a data source can CRUD all data sources

PaddlePaddle command injection in paddle.utils.download._wget_download

PaddlePaddle command injection vulnerability

Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

The Registration role module lets an administrator select a role (or multiple roles) to automatically assign to new users. The selected role (or roles) will be assigned to new registrants. The module has a logic error when handling sites that upgraded code and did not run the Drupal update process

RPyC's missing security check results in code execution when using numpy.array on the server-side.

PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)

PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid

Remote Code Execution by uploading a phar file using frontmatter

esphome vulnerable to stored Cross-site Scripting in edit configuration file API

CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability

CasaOS-UserService allows unauthorized access to any file

Shopware's session is persistent in Cache for 404 pages

Phone information disclosure vulnerability

Apple Multiple Products Memory Corruption Vulnerability

Apple Multiple Products Memory Corruption Vulnerability

`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user

Incorrect TLS certificate auth method in Vault

Coder's OIDC authentication allows email with partially matching domain to register

Sulu grants access to pages regardless of role permissions

pgproto3 SQL Injection via Protocol Message Size Overflow

electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

pgx SQL Injection via Line Comment Creation

JetBrains TeamCity Relative Path Traversal Vulnerability

LangChain directory traversal vulnerability

Integer overflow in chunking helper causes dispatching to miss elements or panic

phpseclib guardrails needed on OID length

phpseclib: guardrails needed on isPrime and randomPrime

Directus has MySQL accent insensitive email matching

Docassemble unauthorized access through URL manipulation

OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

Mattermost post fetching without auditing in compliance export

The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions. This vulnerability is mitigated by the fact that the set of unwanted actions is limited to specific configurations.

ZenML Server Remote Privilege Escalation Vulnerability

diffoscope Path Traversal vulnerability

Bagisto Cross-Site Request Forgery vulnerability

ESPHome vulnerable to remote code execution via arbitrary file write

orjson does not limit recursion for deeply nested JSON documents

langchain Server-Side Request Forgery vulnerability

Uninitialized Variable in fastecdsa

Onnx Directory Traversal vulnerability

`@backstage/backend-common` vulnerable to path traversal through symlinks

Appwrite Directory Traversal vulnerability

pypqc private key retrieval vulnerability

Helm's Missing YAML Content Leads To Panic

Potentially untrusted input is rendered as HTML in final output