Advisory Catalog

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

RestrictedPython guard hooks can be shadowed via positional-only arguments

Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript

asyncssh has SCP Path Traversal to Arbitrary File Write

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows any authenticated user with the KNOWLEDGE capability to pass user-supplied Elastic

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restric