Advisory Catalog

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

Cleo Multiple Products Unauthenticated File Upload Vulnerability

Angular Expressions - Remote Code Execution when using locals

Withdrawn Advisory: Nette Database SQL injection

unstructured XML External Entity (XXE)

Bit flip attack vulnerability in cookie-encrypter

Django SQL injection in HasKey(lhs, rhs) on Oracle

Mongoose search injection vulnerability

hull.js Code Injection Vulnerability

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example, user-supplied input files). Thi

Zyxel Multiple Firewalls Path Traversal Vulnerability

Microsoft Partner Center Improper Access Control Vulnerability

ProjectSend Improper Authentication Vulnerability

libre-chat Path Traversal vulnerability

Flowise OverrideConfig security vulnerability

LLama Factory Remote OS Command Injection Vulnerability

Drupal core contains a potential PHP Object Injection vulnerability

Drupal core contains a potential PHP Object Injection vulnerability

Drupal core contains a potential PHP Object Injection vulnerability

cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes

Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

LibreNMS has an Authenticated OS Command Injection

Improper Restriction of XML External Entity Reference in dompdf/dompdf

Deserialization of Untrusted Data in dompdf/dompdf

GeoVision Devices OS Command Injection Vulnerability

Remote Code Execution on click of <a> Link in markdown preview

FileManager Deserialization of Untrusted Data vulnerability

happy-dom allows for server side code to be executed by a <script> tag

Symfony vulnerable to command execution hijack on Windows with Process class

codechecker vulnerable to authentication bypass when using specifically crafted URLs

codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service

Langflow vulnerable to remote code execution

AgentScope uses `eval`

Glossarizer Cross-site Scripting vulnerability

YesWiki Uses a Broken or Risky Cryptographic Algorithm

DOMPurify vulnerable to tampering by prototype polution

langflow has vulnerability in PythonCodeTool component

ThinkPHP deserialization vulnerability

CyberPanel Incorrect Default Permissions Vulnerability

CyberPanel Incorrect Default Permissions Vulnerability

In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.

Waitress has request processing race condition in HTTP pipelining with invalid first request

Langchain SQL Injection vulnerability

Langchain Path Traversal vulnerability

@langchain/community SQL Injection vulnerability

Lollms vulnerable to Cross-site Scripting

Cleo Multiple Products Unrestricted File Upload Vulnerability

Remote code execution in php-heic-to-jpg

Fortinet FortiManager Missing Authentication Vulnerability

Mitel MiCollab Path Traversal Vulnerability