Advisory Catalog

Keylime has a hardcoded attestation challenge nonce that allows replay attacks

ciguard: SCA HTTP client reads response body without size cap

sse-channel: SSE Injection via unsanitized event fields

AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction

AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

ip-address has XSS in Address6 HTML-emitting methods

AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass

Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel

Grav CMS vulnerable to stored XSS via Markdown media attribute() action

@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS

PyLoad Vulnerable to Path Traversal via Package Folder Name

Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

Kimai vulnerable to formula Injection via tag names in XLSX export

wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured

Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`

Admidio has an incomplete fix for CVE-2026-32812 (SSRF)

requests-hardened is Vulnerable to Server-Side Request Forgery

Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal

AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content

AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers

AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover

OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload

@workos/authkit-session has an Open Redirect via state-derived redirect target

JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)

LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution

OpenStack Horizon has Incorrect Behavior Order

Django has an Improper Handling of Length Parameter Inconsistency

Jupyter Server has an open redirection vulnerability in `next` query parameter

OpenClaw contains a symlink traversal vulnerability

ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption

OpenClaw's Gateway Control UI bootstrap config required Gateway auth

CI4MS has a Deactivated User Session Bypass (active=0)

CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess

OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

OpenClaw's ACP child sessions inherit subagent security envelope constraints

OpenClaw validates Zalo outbound photo URLs through the SSRF guard

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

Pillow has an integer overflow when processing fonts

Pillow has a heap buffer overflow with nested list coordinates

Kirby CMS's system API endpoint leaks installed version and license data to authenticated users

Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations i

PPTAgent: Arbitrary File Write via `save_generated_slides`

PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_image

Funadmin has an Improper Access Control Issue