Advisory Catalog

Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules

wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation

Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API

Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API

Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass

Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access

Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint

django-s3file is vulnerable to relative path traversal

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin a

Langflow Knowledge Bases API is Vulnerable to Path Traversal

FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

phpVMS has an /importer authorization bypass causing full database wipe

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_mod

VM2 Has a WASM Sandbox Escape

VM2 Has a Sandbox Escape Issue via SuppressedError

VM2 Has Sandbox Breakout Through Inspect Function

VM2 Has Sandbox Breakout Through Promise Species

VM2 Sandbox Breakout Through __lookupGetter__

Sentry's improper authentication on SAML SSO process allows user identity linking

n8n has XML Node Prototype Pollution that to RCE

n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE

PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Cockpit is vulnerable to arbitrary code execution

NVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system

GitPython: Unsafe option check validates multi_options before shlex.split transformation

electerm has Command Injection via runLinux funtion

Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

LiteLLM has SQL Injection in Proxy API key verification

Codechecker has an authentication bypass for certain API calls

OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer

A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which only targets MySQL JDBC driver-specific da

Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution

i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE

CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE

CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

OpenClaw: Feishu webhook and card-action validation now fail closed

OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation