Advisory Catalog

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Hono: JWT middleware accepts any Authorization scheme, not only Bearer

pypdf: Manipulated XMP metadata streams can exhaust RAM

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

pypdf: Possible large memory usage for large offsets for layout mode text

json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio

Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export

Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names

Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

Budibase: Unvalidated VectorDB Host Parameter Enables SSRF

Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker

Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step

Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions

Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exce

@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects

LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

Kirby CMS's `pages.access` permission is not checked during rendering of page drafts

Bugsink: Project scoping missing in sourcemap and debug-file lookup

vllm has Improper Resource Shutdown or Release

@koa/router has an Access Control Bypass

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability

Apache ECharts has a cross-site scripting (XSS) vulnerability

hermes-agent has a sandbox issue

hermes-agent has an Injection issue

hermes-agent has an Injection issue

instagrapi: Unsafe signup challenge path handling in instagrapi

aiograpi: Unsafe signup challenge path handling

Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers

Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Concrete CMS is vulnerable to IDOR in surveys

Concrete CMS has a session-hardening bypass and allows password change without reauthorization

Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination

Concrete CMS is vulnerable to unauthenticated page metadata disclosure

Concrete CMS is vulnerable to IDOR

Concrete CMS is vulnerable to IDOR

Concrete CMS is vulnerable to IDOR

Concrete CMS is vulnerable to IDOR combined with a missing authentication gate

Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block