Advisory Catalog

InvokeAI has External Control of File Name or Path

WatchGuard Firebox Out-of-Bounds Write Vulnerability

Flowise has unsandboxed remote code execution via Custom MCP

Flowise has arbitrary file access due to missing chat flow id validation

Flowise has an Arbitrary File Read

Flowise has Remote Code Execution vulnerability

FlowiseAI Pre-Auth Arbitrary Code Execution

mcp-kubernetes-server has an OS Command Injection vulnerability

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Samsung Mobile Devices Out-of-Bounds Write Vulnerability

Picklescan Bypass is Possible via File Extension Mismatch

Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check

Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports

interactive-git-checkout has a Command Injection vulnerability

Prebid-universal-creative latest on npm briefly compromised

Magento Community Edition Improper Input Validation vulnerability

@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API

CodeceptJS's incomprehensive sanitation can lead to Command Injection

internetarchive Vulnerable to Directory Traversal in File.download()

Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

TkEasyGUI Vulnerable to OS Command Injection

Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution

DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more

Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability

Paymenter vulnerable to Remote Code Execution via public file uploads

Sangoma FreePBX Authentication Bypass Vulnerability

The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability

Badaso CMS file upload vulnerability

Citrix NetScaler Memory Overflow Vulnerability

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

sha.js is missing type checks leading to hash rewind and passing on crafted data

cipher-base is missing type checks, leading to hash rewind and passing on crafted data

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

screenshot-desktop vulnerable to command Injection via `format` option

N-able N-Central Command Injection Vulnerability

N-able N-Central Insecure Deserialization Vulnerability

Flowise OS command remote code execution

Flowise vulnerable to RCE via Dynamic function constructor injection

This module enables users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security. The module alters the standard Drupal login form to use AJAX callbacks for handling authentication flow. The module doesn't sufficiently validate authentication under specific co

Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass

ExecuTorch integer overflow vulnerability leads to code execution

ExecuTorch vulnerable to Heap-based Buffer Overflow

ExecuTorch out-of-bounds access vulnerability

ExecuTorch heap buffer overflow vulnerability

ExecuTorch integer overflow vulnerability

ExecuTorch integer overflow vulnerability

Adobe Experience Manager Forms Code Execution Vulnerability

ThinkPHP Path Traversal Vulnerability