Advisory Catalog

Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct U

Shopware vulnerable to a potential take over of app credentials

Shopware: Unauthenticated data extraction possible through store-api.order endpoint

This module creates permissions per node content type to control access to unpublished nodes per content type. The module does not consistently control access for unpublished translated nodes.

The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the ability to use an LLM to generate HTML or Markdown and preview it in a browser. Under certain circumstances, rendering of this HTML can lead to exposing secret communications in the

CraftCMS has an RCE vulnerability via relational conditionals in the control panel

Striae has a hash validation utility vulnerability

@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection

Parse Server's MFA recovery codes not consumed after use

Parse Server has a protected fields bypass via dot-notation in query and sort

CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes

Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

Sylius has a Promotion Usage Limit Bypass via Race Condition

Sylius affected by IDOR in Cart and Checkout LiveComponents

Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

Parse Server OAuth2 authentication adapter account takeover via identity spoofing

Parse Server has a protected fields bypass via logical query operators

Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

Parse Server missing audience validation in Keycloak authentication adapter

Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload

Parse Server has a bypass of class-level permissions in LiveQuery

Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

Elysia has a string URL format ReDoS

pdfmake is vulnerable to server-side request forgery (SSRF)

MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers

Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking

Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting

Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting

StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

Parse Server has a NoSQL injection via token type in password reset and email verification endpoints

Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

LimeSurvey is vulnerable to SQL injection

StudioCMS has Privilege Escalation via Insecure API Token Generation

node-tar Symlink Path Traversal via Drive-Relative Linkpath

liquidjs has a path traversal fallback vulnerability

Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery

NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs

OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects

OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

Glances has SQL Injection via Process Names in TimescaleDB Export

Glances Exposes Unauthenticated Configuration Secrets

OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

@budibase/server: Command Injection in PostgreSQL Dump Command

Apache Airflow Providers Http has Unsafe Pickle Deserializatio leading to RCE via HttpOperator

Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file

x402 SDK Security Advisory

mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft