Advisory Catalog

Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR

Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

league/commonmark has an embed extension allowed_domains bypass

NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)

Parse Server email verification resend page leaks user existence

Improper Authentication and Origin Validation Error in pyload-ng

SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials

Denial of service via non-terminating SYLT frame parsing loop in tinytag

AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php

AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources

AVideo has Unauthenticated PGP Message Decryption via Public Endpoint

AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration

AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk

JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)

Statamic is missing authorization check on taxonomy term creation via fieldtype

Statamic has a path traversal in file dictionary fieldtype

NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability

Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution

h3 has an observable timing discrepancy in basic auth utils

pypdf has inefficient decoding of array-based streams

Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas

Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas

This module provides a site administrator the ability to log users out after a specified time of inactivity. The module doesn't sufficiently protect its routes from cross-site request forgery (CSRF), allowing the logout route to be triggered without user interaction.

SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks

Craft CMS Vulnerable to Stored XSS in Revision Context Menu

Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite

Unauthenticated Reflected XSS via innerHTML in AVideo

Parse Server affected by empty authData bypassing credential requirement on signup

AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php

Parse Server session creation endpoint allows overwriting server-generated session fields

Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Elysia Cookie Value Prototype Pollution

Next.js: HTTP request smuggling in rewrites

Next.js: Unbounded next/image disk cache growth can exhaust storage

Next.js: Unbounded postponed resume buffering can lead to DoS

Next.js: null origin can bypass Server Actions CSRF checks

Apache Airflow: DAG authorization bypass

The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

Admidio is Missing Authorization on Forum Topic and Post Deletion

Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection

Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint

Admidio is Missing CSRF Protection on Role Membership Date Changes

Admidio is Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions

OpenClaw session transcript files were created without forced user-only permissions

Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

Amazon S3 for Craft CMS has an Information Disclosure vulnerability

Craft CMS has a Path Traversal Vulnerability in AssetsController

AWS API MCP File Access Restriction Bypass