Advisory Catalog

cg vulnerable to an Open Redirect Vulnerability on Referer Header

Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book

Moby (Docker Engine) started with non-empty inheritable Linux process capabilities

Apache Answer: XSS vulnerability when changing personal website

Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.

flask-cors vulnerable to log injection when the log level is set to debug

IPv6 enabled on IPv4-only network interfaces

aiohttp Cross-site Scripting vulnerability on index pages for static file handling

Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

Stored Cross-site Scripting (XSS) in excalidraw's web embed component

Evmos vulnerable to unauthorized account creation with vesting module

Cross-site Scripting (XSS) in mindsdb/mindsdb

zenml Session Fixation vulnerability

gradio Server-Side Request Forgery vulnerability

Argo CD's API server does not enforce project sourceNamespaces

Traefik affected by HTTP/2 CONTINUATION flood in net/http

TCPDF Cross-site Scripting vulnerability

Mautic: MST-48 Server-Side Request Forgery in Asset section

Apache Solr Operator liveness and readiness probes may leak basic auth credentials

tiagorlampert CHAOS vulnerable to Cross Site Scripting

Mautic vulnerable to cross-site scripting in notifications via saving Dashboards

Reportico affected by Incorrect Access Control

phin may include sensitive headers in subsequent requests after redirect

Matrix IRC Bridge truncated content of messages can be leaked

Cosign malicious artifacts can cause machine-wide DoS

Cosign malicious attachments can cause system-wide denial of service

zcap has incomplete expiration checks in capability chains.

Portainer CE allows username enumeration through authentication response timing

mysql2 vulnerable to Prototype Poisoning

mysql2 cache poisoning vulnerability

Minder GetRepositoryByName data leak

Contao: Insufficient BBCode sanitizer

Contao: Unencoded insert tags in the frontend

Contao: Cross site scripting in the file manager

Shopware Improper Session Handling in store-api account logout

React Native Sms User Consent Intent Redirection Vulnerability

Archiver Path Traversal vulnerability

Android Pixel Information Disclosure Vulnerability

PsiTransfer: File integrity violation

PsiTransfer: Violation of the integrity of file distribution

Pebble service manager's file pull API allows access by any user

Mattermost Server doesn't limit the number of user preferences

Mattermost Server Improper Access Control

HashiCorpVault does not correctly validate OCSP responses

wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. This vulnerabili

Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check

Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline

Temporal Server Denial of Service

net/http, x/net/http2: close connections when receiving too many headers