Advisory Catalog

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection

Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

protobufjs : Schema-derived names can shadow runtime-significant properties

@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

@angular/service-worker: Request Credential & Cache Policy Stripping

@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

jsonata: Function Binding Prototype Pollution via hasOwnProperty Override

Microweber vulnerable to Path Traversal

OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

OpenClaw: Node pairing reconnection could confuse approval scope state

OpenClaw: Mattermost handlers could fall open when channel type was missing

OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts

OpenClaw: Mattermost slash token revocation could lag until monitor refresh

OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied

parse-server: Server option routeAllowList is bypassable through batch sub-requests

Tornado has out-of-bounds memory access via C extension

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections,

Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

OpenClaw's browser act interactions could bypass private-network navigation checks

OpenClaw: Embedded runner policy could be confused by provider aliases

OpenClaw: Skill Workshop apply flow could override pending approval

Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields

@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch

@steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media Responses