Advisory Catalog

The Login Disable module prevents users from logging in to your Drupal site unless they know the secret key to add to the end of the login form page. The module doesn't sufficiently protect the disabled login form from brute force attacks. Depending on the length of the key this could allow an atta

protobufjs: Text Format string map parsing can mutate returned map object prototype

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

CyberChef: Prototype pollution in Series Chart operation

n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion

ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path

aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address

Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows

@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

Phoenix: Presence keys colliding with `Object.prototype` members break existence checks

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

Django: GDALRaster may over-read heap memory when constructed from bytes

EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose

ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

Apache Airflow exposes deferred trigger kwargs in task-instance API responses

apache-airflow DAG source authorization bypass exposes co-located DAG source

Apache Airflow exposes secrets backend credentials through the Config API

Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph

Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API

showdown allows stored cross-site scripting through table header ID injection

Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint

showdown metadata title handling allows cross-site scripting

vLLM: Speech-to-text upload size limit is enforced after full UploadFile read

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

WeasyPrint has CSS Injection via Presentational Hints

react-dev-utils openBrowser permits command injection on macOS

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API

Froxlor: Authenticated customers can read other customers' allowed sender aliases

@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

@asymmetric-effort/specifyjs: No redirect target validation in secureFetch

@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction

@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)

@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state

@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Craft CMS: Stored XSS via Structure entry title in table view

Wagtail: Pages translations can be created without page permissions when using simple_translation

Wagtail: Improper permission handling in image preview