Advisory Catalog

Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

borg extract might modify out-of-tree files when extracting maliciously crafted archives

Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

ApostropheCMS: Page REST API authorization bypass

Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree

qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Appium: Symlink based Zip Slip in @appium/support ZIP extraction

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

YOURLS: Unauthenticated File Inclusion

unstructured: Stored XSS via unescaped HTML generation

JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

Backstage: Improper access control in backend action invocation

copyparty FTP: upload outside defined volumes (limited path traversal)

obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

Shiny for Python has path traversal in bookmark restore

Contao: Improper access control in the preview links module

Contao: Improper access control in the table access voter

Contao: Path traversal in the images controller

Contao: The registration module re-sends activation mails

Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

fast-jwt: Verifier cache accepts expired JWTs without iat.

Banks: User-controlled prompt input can be parsed as privileged chat messages

AdonisJS: Unencoded route parameters can produce open redirects

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

Indico: Cross-Site-Scripting in minutes editor

Indico: Cross-Site-Scripting in link fields

Indico: Missing access check in legacy session export API

Indico: Incomplete Server-Side Request Forgery (SSRF) check

music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort

svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

music-metadata: Uncontrolled memory allocation in APEv2 parser

MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

msgpack5: Partial options disable prototype protection

msgpack5: Reserved byte can cause unbounded stream buffering