Advisory Catalog

Vyper's external calls can overflow return data to return input buffer

Dash apps vulnerable to Cross-site Scripting

Classic builder cache poisoning

Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2

Bref's Uploaded Files Not Deleted in Event-Driven Functions

glance-store logs s3 access keys

Hashicorp Vault may expose sensitive log information

Grafana Cross Site Request Forgery (CSRF)

Moby (Docker Engine) Insufficiently restricted permissions on data directory

containerd environment variable leak

moby docker daemon crash during image pull of malicious image

moby Access to remapped root allows privilege escalation to real root

Path Traversal in Moby builder

Enumeration of users in HashiCorp Vault

Privilege Escalation in HashiCorp Consul

Grafana Arbitrary File Read

BuildKit vulnerable to possible panic when incorrect parameters sent from frontend

nodemailer ReDoS when trying to send a specially crafted email

stereoscope vulnerable to tar path traversal when processing OCI tar archives

C5 Firefly III CSV Injection.

OctoPrint Unverified Password Change via Access Control Settings

The Entity Delete Log module tracks the deletion of configured entity types, such as node or comments. It does not add sufficient permission to the log report page, allowing an attacker to view information from deleted entities.

@lobehub/chat vulnerable to unauthorized access to plugins

Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

Apache ServiceComb Service-Center Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records

Improper Preservation of Permissions in etcd

HashiCorp Vault Improper Privilege Management

`goreleaser release --debug` shows secrets

Vyper's raw_call `value=` kwargs not disabled for static and delegate calls

vantage6 may create unencrypted tasks in encrypted collaboration

Craft CMS Audit Plugin Cross Site Scripting vulnerability

aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

OpenFGA denial of service

Null pointer dereference in PKCS12 parsing

Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Cross-site Scripting Vulnerability on Data Import

Whoogle Search Path Traversal vulnerability

Whoogle Search Cross-site Scripting vulnerability

No permission checks for editing/deleting records with CSV import form

Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter

View permissions are bypassed for paginated lists of ORM data

@hono/node-server cannot handle "double dots" in URL

Prototype pollution not blocked by object-path related utilities in hoolock

html injection vulnerability in the `tuitse_html` function.

Cross-site Scripting in Ghost

Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry

JupyterLab vulnerable to SXSS in Markdown Preview

Cross-site scripting (XSS) in Action messages on Avo

Broken Access Control order API in Shopware