Advisory Catalog

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file vllm/model_executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack i

i18next-http-backend incomplete URL validation permits SSRF

LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

Ghost: Server-Side Request Forgery in Webhook Trigger

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Next.js has information disclosure in development server's Model Context Protocol endpoint

KaTeX: Existing prototype pollution can bypass trust restrictions

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Laravel: XSS in Debug Page Information

@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data.

This module enables sites to block access for the administrative user account (user 1) or users with the administrator role. The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be abl

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content. This vulnerability is mitigated by the fact that an attacker

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view subm

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that authenticate

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies. In some configurations, due to improper sanitisation, specially

Unleash: CR-approval email renders user-controlled raw HTML

wlc may disclose API tokens to project-configured URLs

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests

October CMS: PHP Object Injection via Backend Widget Session Storage

October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity provi

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently prevent reuse of previously accepted SAML assertions. Under certain circumstances, a valid assertion may be repl

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related s

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity provi

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting vulnerabili

undici vulnerable to downstream response splitting via retry interceptor

SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor

The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks.

This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports > Mail log. The module doesn't sufficiently redact the content of the emails it logs. Account related emails are stored with their one-time login links intact, so any user who can v

This `islandora_advanced_search` sub module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to r

This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module doesn't sufficiently sanitize for cross site scripting (XSS) when using the structured results using legacy agent setups. This vulnerability is mitigated by the fact that an attac

joi: Prototype pollution via a `__proto__` language key in custom messages

joi: object().rename() with a template target can set the validated object's prototype

Filament: Password validity disclosure for accounts denied panel access on login page

multer vulnerable to file size limit bypass via async fileFilter race condition

PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

OpenSTAManager has HTML Injection in modules/utenti/edit.php

The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted. A site administrator might inadvertently grant this permission to less-trusted users. This would allow those users to execute Twig within email templat

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Thi

This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirely.

kas Persistently Disables SSH Host Key Checking

NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure

Wagtail: Identification of documents by SHA1 hash

Winter: Stored XSS through Backend List widget image columns