Advisory Catalog

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

hashi-vault-js has a path traversal and query parameter injection

dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

fast-uri vulnerable to host confusion via backslash authority introducer

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook

dssrf has an SSRF bypass with remove_at_symbol_in_string

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

The Token Content Access module enables site administrators to provide access to content using access tokens. The module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to guess a valid access token and bypass access

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

swagger-typescript-api vulnerable to code injection via unescaped enum string values

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

nanoid: non-secure generators can loop indefinitely with negative size

nanoid: custom generators can loop indefinitely when size is zero

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

pytonapi has a Webhook Custom Path Authentication Bypass

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

@wakaru/cli arbitrary file write during bundle unpack

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability