Advisory Catalog

Check Point Multiple Products Path Traversal Vulnerability

Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

vm2 contains a sandbox escape vulnerability

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

vm2: Sandbox Escape (NodeVM)

vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector

vm2 NodeVM can replace the host process TLS trust store

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

vm2 crypto builtin loads attacker native code through setEngine

vm2 allows a sandboxed plugin to execute native code through `node:sqlite`

vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

djust has an authorization bypass on the WebSocket/SSE mount path

Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Cisco Secure Email Gateway SQL Injection Vulnerability

GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

yayson: Prototype pollution in Store/LegacyStore deserialization

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

Check Point Multiple Products Improper Certificate Validation Vulnerability

Astro: Remote code execution through AVIF image optimization

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API

@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

N-able N-central Static Code Injection Vulnerability

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability