Advisory Catalog

The Drupal Swift Mailer module extends the basic e-mail sending functionality provided by Drupal by delegating all e-mail handling to the Swift Mailer library. This enables your site to take advantage of the many features which the Swift Mailer library provides. The module could allow an attacker t

Open Social is a Drupal distribution for online communities. The included optional social\_group\_flexible\_group module doesn't sufficiently validate group updates. The lack of validation makes it possible to have content inside the group changing it's visibility, which could lead to that content

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. In some cases, the module allows users to log in with an authentication plugin that an administrator has disabled. This vulnerability is mitigated by the fact that an

Whoogle Search Path Traversal vulnerability

Whoogle Search Server-Side Request Forgery vulnerability

Cross-site Scripting in Apache superset

Code execution in pandasai

SQL injection in llama-index

Unsafe yaml deserialization in llama-hub

Code execution in Embedchain

D-Link DIR-859 Router Path Traversal Vulnerability

Code Injection in paddlepaddle

Arbitrary Code Execution in Pillow

concat built-in can corrupt memory in vyper

Unsecured endpoints in the jupyter-lsp server extension

Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

Blind SQL injection in shopware

Privilege escalation for users that can access mock configuration

Atlassian Confluence Data Center and Server Template Injection Vulnerability

Remote Code Execution vulnerability in Apache IoTDB via UDF

EverShop at risk to unauthorized access via weak HMAC secret

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

GitLab Community and Enterprise Editions Improper Access Control Vulnerability

Gentoo Portage missing PGP validation of executed code

WWBN AVideo Insufficient Entropy vulnerbaility

Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC

CouchAuth host header injection vulnerability leaks the password reset token

PaddlePaddle stack overflow in paddle.searchsorted

PaddlePaddle stack overflow in paddle.linalg.lu_unpack

PaddlePaddle heap buffer overflow in paddle.repeat_interleave

PaddlePaddle command injection in get_online_pass_interval

PaddlePaddle command injection in _wget_download

PaddlePaddle command injection in convert_shape_compare

plotly.js prototype pollution vulnerability

Arbitrary remote code execution within `wrangler dev` Workers sandbox

A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The p

bsock uses weak hashing algorithms

MLFlow Path Traversal Vulnerability

MLflow Server-Side Request Forgery (SSRF)

Pedroetb TTS-API OS Command Injection

transformers has a Deserialization of Untrusted Data vulnerability

yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182

Cross-site Scripting in @spscommerce/ds-react

Path traversal in MLflow

Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability

External Control of File Name or Path in h2oai/h2o-3

Escalation of privileges in @sap/xssec

Improper Privilege Management in sap-xssec