Advisory Catalog

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

YOURLS: Unauthenticated File Inclusion

A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code may

nodejs-whisper allows OS command injection through crafted audio file paths

git-diff: OS command injection vulnerability via crafted strings to the gitDiff API

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Microsoft Windows Command Injection Vulnerability

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

Qwik: Crashing any Qwik Server via Resource thenable

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

unstructured: Stored XSS via unescaped HTML generation

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

Backstage: Improper access control in backend action invocation

copyparty FTP: upload outside defined volumes (limited path traversal)

obsidian-tc tokens can access arbitrary configured vaults