Advisory Catalog

Trend Micro Apex One OS Command Injection Vulnerability

pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)

The ADOdb sqlite3 driver allows SQL injection

Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability

@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers

MS SWIFT Remote Code Execution via unsafe PyYAML deserialization

BentoML SSRF Vulnerability in File Upload Processing

Node-SAML SAML Signature Verification Vulnerability

CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module

Node-SAML SAML Authentication Bypass

NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access

nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CrushFTP Unprotected Alternate Channel Vulnerability

form-data uses unsafe random function in form-data for choosing boundary

simogeo/filemanager arbitrary file upload vulnerability

Livewire is vulnerable to remote command execution during component property update hydration

Fortinet FortiWeb SQL Injection Vulnerability

Cisco Identity Services Engine Injection Vulnerability

pyLoad vulnerable to XSS through insecure CAPTCHA

LaRecipe is vulnerable to Server-Side Template Injection attacks

Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability

docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token

Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests

This module enables users to login by email address with the minimal configurations. The module included some protection against brute force attacks on the login form, however they were incomplete. An attacker could bypass the brute force protection allowing them to potentially gain access to an ac

mcp-remote exposed to OS command injection via untrusted MCP server connections

LLaMA-Factory allows Code Injection through improper vhead_file safeguards

Cisco Identity Services Engine Injection Vulnerability

Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

LangChain Community SSRF vulnerability exists in RequestsToolkit component

pbkdf2 silently disregards Uint8Array input, returning static keys

pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos

rfc3161-client has insufficient verification for timestamp response signatures

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

Taylored webhook validation vulnerabilities

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

MCP Inspector proxy server lacks authentication between the Inspector client and proxy

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.

A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.

An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

Salt vulnerable to directory traversal attack in file receiving method

@nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests

Erxes Incorrect Access Control vulnerability

Magneto contains stored XSS vulnerability

BackendAI Missing Authentication for Critical Function