Advisory Catalog

Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.

Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

Statmic CMS vulnerable to account takeover via XSS and password reset link

livewire Cross-Site Request Forgery vulnerability

Improper Authentication in HashiCorp Vault

Denial of service in HashiCorp Consul

runc vulnerable to container breakout through process.cwd trickery and leaked fds

BuildKit vulnerable to possible race condition with accessing subpaths from cache mounts

Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

Linux Kernel Use-After-Free Vulnerability

Apache ServiceComb Service-Center Server-Side Request Forgery vulnerability

HashiCorp Vault Authentication bypass

Etcd Gateway can include itself as an endpoint resulting in resource exhaustion

react-query-streamed-hydration Cross-site Scripting vulnerability

@urql/next Cross-site Scripting vulnerability

@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability

vantage6 remote code execution vulnerability

Craft CMS Feed-Me

aiohttp is vulnerable to directory traversal

Authentik vulnerable to PKCE downgrade attack

Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF

MeshCentral algorithm-downgrade issue

A vulnerability classified as critical was found in van_der_Schaar LAB TemporAI 0.0.3. Affected by this vulnerability is the function load_from_file of the component PKL File Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to th

Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

Dolibarr Application Home Page has HTML injection vulnerability

Arbitrary Code Execution in Processwire

SQL Injection in Admin download files as zip

Host header injection in the password reset

Content within Open Social can have different visibilities. It is possible for a user to create public content even when this should not be allowed. This vulnerability is mitigated by the fact that the site must have public visibility disabled on a global level.

Sending a GET or HEAD request with a body crashes SvelteKit

Apache Airflow: pickle deserialization vulnerability in XComs

Apache Airflow: Bypass permission verification to read code of other dags

Cross-site Scripting Vulnerability on Avatar Upload

Apple Multiple Products WebKit Type Confusion Vulnerability

XSS potential in rendered Markdown fields (comments, description, notes, etc.)

Minerva timing attack on P-256 in python-ecdsa

chasquid HTTP Request/Response Smuggling vulnerability

Code execution in metagpt

ReDoS in Embedchain

SPV Merkle proof malleability allows the maintainer to prove invalid transactions

github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability

JupyterLab vulnerable to potential authentication and CSRF tokens leak

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Validation of `VoteExtensionsEnableHeight` can cause chain halt in Go package github.com/cometbft/cometbft

Marvin Attack of RSA and RSAOAEP decryption in jsrsasign

Cross-Frame Scripting vulnerability has been found on Plone CMS

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

crystals-go vulnerable to KyberSlash (timing side-channel attack for Kyber)

Drupal core Denial of Service