Advisory Catalog

Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction

pypdf: manipulated stream length values can exhaust RAM

Sylius has a DQL Injection via API Order Filters

Sylius Vulnerable to Authenticated Stored XSS

Sylius has a XSS vulnerability in checkout login form

Sylius is Missing Authorization in API v2 Add Item Endpoint

Sylius has an Open Redirect via Referer Header

django-unicorn affected by component state manipulation via unvalidated attribute access

file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header

Parse Server has a rate limit bypass via batch request endpoint

Craft Commerce: Potential IDOR in Commerce carts

Craft Commerce has stored XSS in Inventory Location Name

@appium/support has a Zip Slip arbitrary file write in its ZIP extraction

copyparty: volflag `nohtml` did not block javascript in svg files

Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

OneUptime has WhatsApp Resend Verification Authorization Bypass

Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

flarum/nicknames extension has display name injection in notification emails (autolink & markdown)

OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions

OpenClaw: system.run allow-always persistence included shell-commented payload tails

OpenClaw: `operator.write` chat.send could reach admin-only config writes

OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping

OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers

OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots

OpenClaw's hooks count non-POST requests toward auth lockout

Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter

An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackers to obtain sensitive information.

Actual Sync Server has an Authenticated Path Traversal

Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization

Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory

AVideo has Unauthenticated IDOR - Playlist Information Disclosure

PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`

Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)

CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names

parse-server: Malformed `$regex` query leaks database error details in API response

parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction

Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens

Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint

Flowise has Insufficient Password Salt Rounds

mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint

Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface

Fonoster is vulnerable to directory traversal

Leantime has HTML injection through firstname and lastname fields

Mercurius: Incorrect Content-Type parsing can lead to CSRF attack

django-allauth has an open redirect vulnerability

@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass

eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write