Advisory Catalog

OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions

AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle

AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings

AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents

Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload

Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata

srvx is vulnerable to middleware bypass via absolute URI in request line

Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL

Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php

PrestaShop: Improper Use of Validation Framework

n8n Vulnerable to LDAP Filter Injection in LDAP Node

n8n Vulnerable to XSS via Binary Data Inline HTML Rendering

n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no

n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK

@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers

@grackle-ai/powerline Runs Without Authentication by Default

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items

MobSF has SQL Injection in its SQLite Database Viewer Utils

Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions

Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations

Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

Parse Server's Session Update endpoint allows overwriting server-generated session fields

ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads

H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation

Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents

Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin

Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground

AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()

AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data

AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

HybridAuth Has Improper SSL Certificate Validation in Curl HTTP Client

Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the URL field. Attackers can paste a buffer of 5000 characters into the 'From URL' field during torrent addition to trigger an application crash.

Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Webseeds field. Attackers can paste a buffer of 5000 bytes into the Webseeds field during torrent creation to trigger an application crash.

AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin

AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization

AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php

h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

Parse Server has a protected field change detection oracle via LiveQuery watch parameter

PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel