Advisory Catalog

sigstore-go fails to check signature timestamps against a signing key's validity period

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

Contao: Possible path traversal in job download URIs

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Savon::Model evaluates WSDL operation names as Ruby source

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao crawler leaks auth credentials to external hosts

Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

hashi-vault-js has a path traversal and query parameter injection

dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests