Advisory Catalog

Waku has an Open Redirect via `unstable_redirect` Helper

Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests

`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

Composer: Arbitrary file write outside vendor via malicious transitive package name

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

pypdf: Possible infinite loop for not terminated inline images

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

LiteLLM: Local file read via request-supplied OIDC file references

LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

pypdf: Possible large memory usage for wrong image dimensions

pypdf: Possible long runtimes for repeated malformed cross-reference entries

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending content of an entity (including its comments) to an LLM, then converts the model's Markdown response to HTML and stores it for display to privileged users. The generated HTML was rendered without passing through Drupal's f

This module enables you to use Single Directory Components in site building (views, field formatters, blocks, layouts) and it improves the Developer Experience (DX) with SDC. The module doesn't sufficiently sanitize the markup passed to components under certain scenarios. This vulnerability is mit

Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Mistune: XSS via unescaped class option in Admonition directive

Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Mistune: Arbitrary File Read via Include directive path traversal

Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

hono/jsx does not isolate context per request, leading to cross-request data disclosure

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header