Advisory Catalog

Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Trix: Stored XSS via HTMLParser attribute injection on paste

Valibot: record() issue paths can make flatten() throw for inherited Object property names

SvelteKit: Prototype pollution in file input deletion path in remote-function forms

SvelteKit: Big remote form function payloads can cause Node process to crash

Hugging Face Datasets folder-based builders allow path traversal through file_name metadata

BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

React Router: Open redirect leading to XSS

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab PluginManager lock-rule enforcement bypass

Next.js: Cache confusion of response bodies for requests with bodies

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Next.js: Unbounded Server Action payload in Edge runtime

Next.js: Denial of Service in the Image Optimization API using SVGs

Next.js: Unauthenticated disclosure of internal Server Function endpoints

Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

danger allows local OS command injection through crafted file paths

n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory

n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service

n8n: SSRF Protection Bypass via MCP Client Node

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

This module enables you to add autocomplete suggestions for search forms created with the [Search API module](/project/search_api). The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability

This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting (XSS) vulnerabili

n8n: Google Service Account Private Key Exposed in JWT Header

n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data

n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

TypeORM: migration:generate template-literal code injection

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.