Advisory Catalog

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Flowise RCE via SQLite Record Manager Node

Flowise: Remote Code Execution Vulnerability in CSVAgent

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise Sandbox Escape to RCE

Flowise RCE via TypeORM DataSource

Sequelize: SQL Injection (Oracle DB)

NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Broadcom VMware vCenter Path Traversal Vulnerability

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Shescape: Shell injection via unescaped parentheses on Windows with CMD

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Budibase: SQL Injection via `multipleStatements: true`

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

@better-auth/scim: account takeover and stale access via SCIM provider-id collision

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

The Photoswipe Drupal module provides integration for the widely used [PhotoSwipe lightbox library](https://photoswipe.com/) to display / zoom images in lightbox galleries using the provided image formatters. The module didn't sufficiently check access permissions, when viewing an image using the p

This module enables you to retrieve and submit webform submissions via REST endpoints. The module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions. This vulnerability is mitigated by the fact that an attacker must already have permissions t

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

In a scenario of a multilingual website with different domain names per language, this module enables you to be automatically connected across the language domains if you are logged on the main language domain. The module doesn't sufficiently validate a short-lived token, allowing an attacker to by

Check Point SmartConsole Improper Authentication Vulnerability

GitPython unsafe clone option gate bypass through joined short options

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding

Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

WordPress Core Interpretation Conflict Vulnerability

IBM Langflow Code Injection Vulnerability

Sangoma Switchvox SQL Injection Vulnerability

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Snowflake Connector for Python improperly verifies TLS hostnames

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

GPT Researcher MCP STDIO configuration allows remote command execution

websocket-driver: Message corruption via abuse of protocol length headers