Advisory Catalog

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Handlebars: JavaScript Injection via Own Property Check Bypass

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Payload authentication token field handling issue

Payload: Unauthorized update to collection documents

Payload Form Builder has an RCE issue

Payload: Field access control bypass on auth collections

Payload: Prototype pollution in Payload Import Export plugin

Payload: SQL Injection in SQLite and Postgres

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Ahsay AhsayCBS Command Injection Vulnerability

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

Trigger.dev: V1 coordinator default-secret unauth Socket.IO

Tinypool: Prototype Pollution Gadget to RCE in run() options

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Fortinet FortiMail Path Traversal Vulnerability

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

Zammad GmbH Zammad Improper Privilege Management Vulnerability

Zammad GmbH Zammad Session Fixation Vulnerability

Next.js: Remote Code Execution in next/og ImageResponse

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection

simple-git unsafe-operation guard does not block trailer command configuration

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

PyJWT: PyJWKClient follows redirects when fetching JWKS

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

Authlib: empty signatures validation in JWS JSON deserialization

@xhmikosr/decompress: Path traversal via symlink chain

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix NetScaler Improper Input Validation Vulnerability

vm2: NodeVM custom resolution bypasses external path boundaries

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code when

SunEditor: Critical XSS vulnerability - sanitizer bypass

Home Assistant: XSS in Statistics Graph Card

plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability