Advisory Catalog

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

league/commonmark: Denial of service via deeply nested XML output

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

Silverstripe: XSS in breadcrumbs in page list view

Mermaid radar diagrams are vulnerable to DoS

Mermaid allows CSS injection applying to sibling elements of the diagram

Mermaid Architecture diagrams are vulnerable to prototype pollution

Mermaid XY Charts are vulnerable to an infinite loop DoS

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials t

Nuxt: Unauthorized Component Instantiation via Server Island Props

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an atta

Electron: Sandboxed iframes can launch external protocol handlers

Electron: DevTools embedder handler executes arbitrary files via shell open

Electron: contextBridge object copy honors prototype setters

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Electron: window.open features string controls some window options considered privileged

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Electron: HTTP redirect followed into local file loader

Electron: Extension tab APIs operate across session boundaries

Electron: shell.openPath path validation bypass via embedded null byte

Electron: Cross-origin iframe can position native autofill popup

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

Electron: Parent process code-sign check is spoofable

Ghost: Cross-Site Scripting in Feature Image Captions

Ghost: Server-Side Request Forgery Mitigation Issue

Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering

Ghost: Session Fixation in Ghost Admin

Ghost: Theme Upload Path Traversal

Ghost: Database Backup Path Traversal

Ghost: Server-Side Request Forgery in Image Fetching

Ghost: Blind Password Hash Disclosure in Ghost Admin API

Ghost: Archived Offers can be Redeemed

Ghost: Cross-Site Scripting in Universal Import

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint