Advisory Catalog

In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring

Magento Open Source Improper Access Control vulnerability

Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a `wasmtime::Engine`'s internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potentially type registry corruption. That registry corruption coul

LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Templates" feature

ipl/web's `ipl\Web\Common\CsrfCounterMeasure` is susceptible to CSRF

The fuels-ts typescript SDK has no awareness of to-be-spent transactions

Undici vulnerable to data leak when using response.arrayBuffer()

yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services

Cross-site Scripting in djangorestframework

Mattermost Desktop App allows for bypassing TCC restrictions on macOS

@strapi/plugin-content-manager leaks data via relations via the Admin Panel

Improper authentication in zenml

Race condition in zenml

Typo3 Information Disclosure in Page Tree

Acquia DAM provides a connection to a third-party asset management system, allowing for images to be managed, linked to, and viewed from Drupal. In order for assets to be managed in Drupal, a site administrator must first authenticate the site to their DAM instance. The module doesn't sufficiently

Information Disclosure in TYPO3 CMS

Arbitrary JavaScript execution due to using outdated libraries

Slack integration leaks sensitive information in logs

Password confirmation stored in plain text via registration form in statamic/cms

Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability

silverstripe/framework sends passwords back to browsers under some circumstances

silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled

silverstripe/framework password encryption salt not updated

Silverstripe admin XSS Vulnerability via WYSIWYG editor

vantage6 collaboration admins can extend their influence by expanding the collaboration

Passbolt Api Retrieval of HTTP-only cookies

random_compat Uses insecure CSPRNG

onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.

Insecure deserialize Vulnerability in FLOW3

Monolog Header injection in NativeMailerHandler

Laravel Encrypter Failure to decryption vulnerability

datadog/dd-trace Circumvents open_basedir INI directive

thelounge may publicly disclose of all usernames/idents via port 113

LIEF obtain sensitive information via the name parameter

Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

Improper Certificate Validation vulnerability in Apache Airflow FTP Provider

Enabling Authentication does not close all logged in socket connections immediately

Prototype pollution in emit function

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

RosarioSIS cross site scripting vulnerability

phpMyFAQ Path Traversal in Attachments

Dynamic Variable Evaluation in qiskit-ibm-runtime

[TagAwareCipher] - Decryption Failure (Regex Match)

fgr Vulnerable to Insecure Default Variable Initialization

Session Token in URL in directus

Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin

PyPop C extensions possible vulnerability: missing arguments and redundant null pointers

tuf's Metadata API: Targets.get_delegated_role() is missing input validation

commonground-api-common unexploitable privilege escalation in JWT authentication middleware