Advisory Catalog

laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

llama_index vulnerable to SQL Injection

Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

billboard.js allows prototype pollution via the function generate

Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability

LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id

Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

Versa Concerto Improper Authentication Vulnerability

The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution

vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

Langroid has a Code Injection vulnerability in TableChatAgent

samlify SAML Signature Wrapping attack

laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK

Apache IoTDB Vulnerable to Remote Code Execution

Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability

Samsung MagicINFO 9 Server Path Traversal Vulnerability

SAP NetWeaver Deserialization Vulnerability

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the mal

Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL

SQL injection in ADOdb PostgreSQL driver pg_insert_id() method

ShowDoc unrestricted file upload vulnerability

vLLM Vulnerable to Remote Code Execution via Mooncake Integration

YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

Craft CMS Allows Remote Code Execution

SAP NetWeaver Unrestricted File Upload Vulnerability

h11 accepts some malformed Chunked-Encoding bodies

CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

Commvault Command Center Path Traversal Vulnerability

Crawl4AI SSRF vulnerability

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

croogo Host header injection

Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability

Pycel allows code injection via a crafted formula

Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Apple Multiple Products Arbitrary Read and Write Vulnerability

Apple Multiple Products Memory Corruption Vulnerability

DevDojo Voyager Argument Injection vulnerability

TigerVNC accessible via the network and not just via a UNIX socket as intended

yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency