Advisory Catalog

Filament Unvalidated Range and Values summarizer values can be used for XSS

Statamic has Stored XSS via SVG Sanitization Bypass

Parse Server leaks protected fields via LiveQuery afterEvent trigger

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

socket.io allows an unbounded number of binary attachments

OneUptime WhatsApp Webhook Missing Signature Verification

OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution

h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read

Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)

Frigte has broken access control viewer user can delete admin and other users account

UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

UltraJSON has a Memory Leak parsing large integers allows DoS

SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

Langflow is Missing Ownership Verification in API Key Deletion (IDOR)

AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

Ray Dashboard is vulnerable to path traversal through its static file handling mechanism

music-metadata has an infinite loop vulnerability in ASF parser

AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Nest Fastify HEAD Request Middleware Bypass

Parse Server LiveQuery subscription with invalid regular expression crashes server

Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Parse Server crash via deeply nested query condition operators

jsPDF has a PDF Object Injection via FreeText color

Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()

Denial of Service in pyasn1 via Unbounded Recursion

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutati

Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization

Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications

Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata

Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey

Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)

File Upload(RCE) Vulnerability in admidio

OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion

OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs

Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries

Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability

Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

Craft CMS vulnerable to behavior injection RCE via EntryTypesController

RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin

Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

Glances's Default CORS Configuration Allows Cross-Origin Credential Theft

Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials

Glances has a Command Injection via Process Names in Action Command Templates

Glances exposes the REST API without authentication