Advisory Catalog

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape

Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

pytonapi has a Webhook Custom Path Authentication Bypass

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

OAuth: Cross-origin token-request redirects can expose signed request metadata

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

@wakaru/cli arbitrary file write during bundle unpack

GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions