Advisory Catalog

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

The Events, Conditions, Actions (ECA) module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models. The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure. This vulnerability is

The module doesn't sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code; this could be exploited to achieve Cross-Site Scripting (XSS). This vulnerability is mitigated by the fact that an attacker must have a role with the permission "admin

The Location Selector module provides a Views filter for selecting location values. One of the provided Views filters does not sufficiently sanitize values that may come from user input, resulting in a SQL injection vulnerability. This vulnerability is mitigated by the fact that a View must exist

The Lingotek Ray Enterprise Translation module provides multilingual site management. The module fails to protect several state-changing administrative routes against Cross Site Request Forgery attacks. An attacker could trick a privileged user into visiting a crafted page that triggers actions suc

The Login Disable module prevents users from logging in to your Drupal site unless they know the secret key to add to the end of the login form page. The module doesn't sufficiently protect the disabled login form from brute force attacks. Depending on the length of the key this could allow an atta

Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

protobufjs: Denial of Service via infinite loop in .proto option parsing

protobufjs: Text Format string map parsing can mutate returned map object prototype

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

node-tar: Negative tar entry size causes infinite loop in archive replace

node-tar: Decompression/parse DoS via unlimited input

node-tar: Process crash via PAX numeric path type confusion

js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

js-yaml: YAML merge-key chains can force quadratic CPU consumption

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

Socket.IO: Engine.IO WebTransport SID DoS

CyberChef: Prototype pollution in Series Chart operation

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above

BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction