Advisory Catalog

joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register)

AstrBot is vulnerable to RCE with hard-coded JWT signing keys

Fortinet FortiWeb Path Traversal Vulnerability

pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode

Gladinet Triofox Improper Access Control Vulnerability

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

expr-eval does not restrict functions passed to the evaluate function

@react-native-community/cli has arbitrary OS command injection

Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

MLflow Weak Password Requirements Authentication Bypass Vulnerability

pg8000 SQL injection vulnerability via a specially crafted Python list input

Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability

pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer

Keras framework vulnerable to deserialization of untrusted data

bagisto has CSV Formula Injection in Create New Product

PrestaShop Checkout allows customer account takeover via email

happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript

F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability

Happy DOM: VM Context Escape can lead to Remote Code Execution

BBOT's various issues in unarchive.py can cause arbitrary file write and RCE

BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE

Better Auth: Unauthenticated API key creation through api-key plugin

scio is vunerable to Remote Command Execution through PyTorch

Flowise is vulnerable to arbitrary file write through its WriteFileTool

Melis Platform CMS Unauthenticated File Upload Leading to RCE

Melis Platform CMS Unauthenticated Admin Account Creation

Melis Platform CMS SQL Injection

SillyTavern Web Interface Vulnerable DNS Rebinding

Oracle E-Business Suite Unspecified Vulnerability

Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel

phpMyFAQ duplicate email registration allows multiple accounts with the same email

Django vulnerable to SQL injection in column aliases

Apache Pyfory python is vulnerable to deserialization of untrusted data

check-branches is vulnerable to command Injection

get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

cors-anywhere vulnerable to server-side request forgery

magix-combine-ex vulnerable to prototype pollution

Command Injection in adb-mcp MCP Server

Google Chromium V8 Type Confusion Vulnerability

Apache IoTDB: Deserialization of untrusted Data

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

H2O affected by a deserialization vulnerability

CWP Control Web Panel OS Command Injection Vulnerability

@digitalocean/do-markdownit has Type Confusion vulnerability

Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability