Advisory Catalog

parse-server: Server option routeAllowList is bypassable through batch sub-requests

Tornado has out-of-bounds memory access via C extension

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections,

Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

OpenClaw's browser act interactions could bypass private-network navigation checks

OpenClaw: Embedded runner policy could be confused by provider aliases

OpenClaw: Skill Workshop apply flow could override pending approval

Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields

@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch

@steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media Responses

Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

@hapi/inert has a static-file confinement bypass via sibling-prefix path

python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator

guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation

guzzlehttp/psr7 has CRLF Injection via URI Host Component

Sharp Missing Authorization Check in Quick Creation Command Endpoints

PDM: Project-Local State and Config Writes Follow Symlinks

Weblate SSRF: outbound URL guard misses some private ranges

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking the Composer module for Drupal project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-

This module integrates the Tagify JavaScript library to enhance entity reference selection in entity reference widgets. The module does not properly sanitise the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This results in a cross-site scripting vulnerability tha

@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture

BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDOR

TYPO3 CMS has Insecure Deserialization via Core API

TYPO3 CMS has Broken Access Control in Backend API

TYPO3 CMS: Broken Access Control in Media Module

TYPO3 CMS has Broken Access Control in its DataHandler

TYPO3 CMS has Broken Access Control in the Recycler Module

TYPO3 CMS has Cross-Site Scripting in Indexed Search

TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities

awxkit has a path traversal vulnerability

Apache Airflow has a Path Traversal issue

Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString

Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications

TYPO3 HTML Sanitizer allows Cross-site Scripting

actual Allows Electron to Run As Node

Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type

Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Bugsink: DOS using large numbers of event tags