Advisory Catalog

Next.js: Denial of Service in App Router using Server Actions

Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Dompdf: Uncontrolled resource consumption based on declared BMP dimensions

danger allows local OS command injection through crafted file paths

n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory

n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service

n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service

n8n: Edit Image Node Format Injection Allows Arbitrary File Write

n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON

n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`

n8n: Expression sandbox escape via arrow-function bodies enabling command execution

n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

n8n: Authenticated code execution in the n8n Git node

n8n: SSRF Protection Bypass via MCP Client Node

n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes

n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Dompdf: File existence oracle via font-face stylesheet declaration

Dompdf: Chroot Validation Bypass

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The Photoswipe Drupal module provides integration for the widely used [PhotoSwipe lightbox library](https://photoswipe.com/) to display / zoom images in lightbox galleries using the provided image formatters. The module didn't sufficiently check access permissions, when viewing an image using the p

This module enables you to retrieve and submit webform submissions via REST endpoints. The module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions. This vulnerability is mitigated by the fact that an attacker must already have permissions t

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

This module enables you to add autocomplete suggestions for search forms created with the [Search API module](/project/search_api). The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability

In a scenario of a multilingual website with different domain names per language, this module enables you to be automatically connected across the language domains if you are logged on the main language domain. The module doesn't sufficiently validate a short-lived token, allowing an attacker to by

This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting (XSS) vulnerabili