Advisory Catalog

Shescape: Shell injection via unescaped parentheses on Windows with CMD

Shescape: Path disclosure on Unix with Zsh

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

NLTK vulnerable to Eval Injection via collocations CLI arguments

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

Budibase: SSRF via DNS rebinding in the REST datasource integration

Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Budibase: Account Enumeration via Login Lockout Response Differential

Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution

Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs

Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile

Budibase: SQL Injection via `multipleStatements: true`

Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Budibase: Privilege escalation via public role assignment API missing app-level authorization

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account