Advisory Catalog

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING

9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

Kiwi TCMS's /init-db/ page renders and responds to requests after first use

SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation

fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

SimpleSAMLphp has Possible DoS via XPath Transform

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalation via /usr/bin/apt-get arguments

@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation

@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write

9router: Missing Authorization and OS Command Injection

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion

Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)

Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API

Froxlor: Authenticated customers can read other customers' allowed sender aliases

electerm has Command Injection in File System Operations (rmrf, mv, cp)

Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling

@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields

Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

SFTPGo has stored XSS via inline parameter on public shares and user file download

SFTPGo has path confinement bypass in public browsable share partial ZIP download

@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

@asymmetric-effort/specifyjs: No redirect target validation in secureFetch

@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction

@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)

@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state

@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection

@asymmetric-effort/specifyjs: URL parse failure silently allows request

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Langroid: Path traversal in the file tools allows read/write outside configured current directory

Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete