Advisory Catalog

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

djust has broken object-level access control (IDOR)

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

djust has an authorization bypass on the WebSocket/SSE mount path

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Svelte devalue: DoS via malformed input

oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

Redocly CLI: Path traversal when using `split` command

LiteLLM Proxy has server-side request forgery via the `user_config` request parameter

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. CKEditor has released [a security update that impacts Drupal](https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp). Vulnerabilities are possible if Drupal is configur

node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

@platejs/core HTML deserialization can trigger browser behavior during parsing

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution

@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler