Advisory Catalog

Payload: SQL injection in SQLite/Postgres

Backstage has improper input validation in TechDocs Markdown extension configuration

Backstage: Improper repository path validation in a Scaffolder backend module

Backstage: Improper validation of TechDocs MkDocs configuration

Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

wger: Trainer Privilege Escalation - Improper Privilege Management

wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

Backstage: Improper validation of MkDocs theme configuration in TechDocs

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

Backstage: Scaffolder action input authorization bypass

Backstage: Improper task state validation in Scaffolder backend

Backstage: Improper URL validation in catalog entity placeholder resolution

Backstage: Improper preservation of access restrictions during service credential delegation

Backstage: Improper authentication in the OIDC provider

Backstage: Improper input validation in Sentry scaffolder actions

Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Backstage: Improper validation of MkDocs plugin configuration in TechDocs

WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Hydra instantiate target blacklist bypasses permit code execution

Hydra logging configuration permits unsafe callable resolution

Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Hydra: Mutable instantiate policy sets allow target blocklist bypass

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Payload: Field-level write access bypass in Payload on MongoDB

Payload: Uploaded XML files could execute same-origin JavaScript

Payload: Client uploads could overwrite S3 objects

Payload: Incomplete validation during the upload file lifecycle

Payload: Bypassed sanitization of user uploaded SVGs

Payload external upload trust validation issue

Payload has a tenant authorization bypass in Multi-Tenant Plugin

Payload: Remote Code Execution through first-register

Payload didn't enforce field-level password update restrictions

Payload: ReDoS in Multipart Content-Type Validation

Payload vulnerable to API key disclosure through ordinary document reads

Payload Ecommerce has an order confirmation validation issue

Payload: Token refresh and password reset responses may expose restricted user fields

Payload: Improper access control for MCP API keys

Payload: Polymorphic join queries could disclose hidden fields

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

Vyper: Memory corruption using function calls within tuples / nested calls

Vyper: Call stack corruption when passing complex type containing non-base type members as argument

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

sharp : Vulnerability in librsvg dependency CVE-2026-96889

Nx: OS command injection via git revisions and remote refs

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens t

GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`