Advisory Catalog

changedetection.io has Reflected XSS in its RSS Tag Error Response

Kimai's API invoice endpoint missing customer-level access control (IDOR)

Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()

Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()

OpenClaw: BlueBubbles (optional plugin) pairing/allowlist mismatch when allowFrom is empty

OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection

OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images

OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard

OpenClaw has agent avatar symlink traversal in gateway session metadata

OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization

OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP

CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created. The module doesn't sufficiently validate the uniqueness of certain u

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created. A visitor who successfully logs in to their Identity Provider and is

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created. The module doesn't sufficiently validate certain fields coming from

The Google Analytics GA4 module enables users to add custom attributes to the script tag used to load the Google Analytics library. The module does not sufficiently sanitize these attributes. This vulnerability is mitigated by the fact that an attacker must have a role with the "ga4 configure" (or

This module extends the Drupal form API adding "Calculation element" form element types, which can evaluate a maths expression. It offers webform integration. The module doesn't sufficiently validate user input; this could be exploited to achieve Information Disclosure or Cross-site Scripting (XSS)

AJAX Dashboard: Entity Dashboards enables you to create configurable dashboards attached to entities which include AJAX-reloading of a main content area based on inputs from a configurable set of buttons. The module doesn't sufficiently check access on the dashboard configuration route. Unauthorize

This module moves files to and from private storage depending on the access of its owning entities. The module does not always validate the access logic correctly, resulting in files attached to an entity not being protected in certain circumstances. This vulnerability is mitigated by the fact tha

This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the results of hook\_file\_download when a custom or contrib module implements that hook leading to access bypass.

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

OpenClaw's serialize sandbox registry writes to prevent races and delete-rollback corruption

OpenClaw's Node role device-identity bypass allows unauthorized node.event injection

OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path

OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch

OpenClaw has Canvas route hardening for mixed-trust deployments

OpenClaw's typed sender-key matching for toolsBySender prevents identity-collision policy bypass

OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks

OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing

OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program

OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallback

OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation

OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions

OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths

OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering

OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

OpenClaw Loopback CDP probe can leak Gateway token to local listener

OpenClaw has a Discord `allowFrom` slug-collision authorization bypass

OpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access

OpenClaw has a IPv6 multicast SSRF classifier bypass

OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write

OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint

OpenClaw has a Feishu allowFrom authorization bypass via display-name collision

OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths

OpenClaw plugin runtime command execution is part of trusted plugin boundary

OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption