Advisory Catalog

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

Siemens Software Center Uncontrolled Search Path Element Vulnerability

Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service

Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service

GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)

GitPython command wrappers omit unsafe protocol and option checks

GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines

GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name

Palo Alto Networks PAN-OS Code Injection Vulnerability

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

Microsoft Windows Command Injection Vulnerability

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

Qwik: Crashing any Qwik Server via Resource thenable

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment

better-auth: Device login approval does not show the requesting client or permissions

Tina: Code injection via unescaped Git branch name in generated client source

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

pyLoad: Api.set_user_permission never invalidates the target's session

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

pyLoad has an authentication bypass in API key validation (check_apikey cache)

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element

music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)

MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

msgpack5: Truncated map32 headers throw an unexpected error

msgpack5: Many buffered values can exhaust the streaming decoder stack

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early