Advisory Catalog

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

hashi-vault-js: Vault token and secret values exposed in thrown errors

ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

baseline-browser-mapping process termination on invalid input causes denial of service

This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and perf

This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations. This vulnerab

This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks.

This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently restrict access to non-node entity revision diffs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to view the entity.

Material for MkDocs: DOM XSS in search suggestions via query parameter

Apache Airflow missing team context permits cross-team Dag actions and XCom reads

Apache Airflow Task SDK fails to mask list-shaped JSON Variables

Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext

Apache Airflow environment-variable secrets backend permits cross-team credential use

JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

Apache Airflow Config API exposes team-scoped sensitive configuration values

Apache Airflow exposes dict-valued var.json secrets in Rendered Templates

Apache Airflow XCom API permits unsafe deserialization through JSON string literals

Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment

Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnosti

tablib: Stored XSS in the HTML export via unescaped dataset title

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

SWC HTML minifier may allow script element breakout when minifying embedded JSON

Accelerate path traversal and denial of service via sharded checkpoint weight_map entries

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in one

Apache Airflow Yandex Lockbox backend allows cross-team secret disclosure

Keras model loading is vulnerable to denial of service through HDF5 shape bombs

JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

pypdf: Possible large memory usage for large /ToUnicode streams

Kirby: System path exposure from error messages in the REST API

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Hono: Algorithmic Complexity DoS in Language Middleware

SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

Smarty Security stream restriction bypass through stream: resource

Smarty: Symlink path traversal out of trusted directories

NLTK downloader allows cross-package resource and model poisoning

h2: Duplicate Host header could facilitate request smuggling

Craft CMS: Incorrect path validation could potentially lead to path traversal

Craft CMS: Stored XSS in the control panel via unescaped draft name