Advisory Catalog

Django has an SQL Injection issue

Django has Inefficient Algorithmic Complexity

Django has an SQL Injection issue

Django has Inefficient Algorithmic Complexity

Moodle Affected by Improper Restriction of Excessive Authentication Attempts

Moodle formula injection vulnerability

Moodle vulnerable to Cross-site Scripting

Moodle Cross-site Scripting (XSS) vulnerability

Moodle authentication bypass vulnerability

Notepad++ Download of Code Without Integrity Check Vulnerability

OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand

OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable

SageMaker Python SDK has Insecure TLS Configuration

SageMaker Python SDK has Exposed HMAC

Fastify's Content-Type header tab character allows body validation bypass

jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution

jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder

Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning

Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption

mlflow Creates of Temporary File in Directory with Insecure Permissions

Lollms has an Improper Access Control vulnerability

RaspAP raspap-webgui contains an OS Command Injection vulnerability

OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl

OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with path traversal sequences (e.g., '../') in the URL. For example, requesting /static/css//../../../../.

@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks

PsySH has Local Privilege Escalation via CWD .psysh.php auto-load

geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure

Salt Authentication Protocol Version Downgrade Allows Minion Impersonation

Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload

fast-xml-parser has RangeError DoS Numeric Entities Bug

Unfurl's unbounded zlib decompression allows decompression bomb DoS

AutoGPT is Vulnerable to RCE via Disabled Block Execution

NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

EGroupware has SQL Injection in Nextmatch Filter Processing

BrowserStack Local vulnerable to Command Injection through logfile variable

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

billboard.js is vulnerable to XSS during chart option binding

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector

Ghost vulnerable to XSS via malicious Portal preview links

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

LibreNMS contains an authenticated SQL Injection vulnerability

MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

Python-Multipart has Arbitrary File Write via Non-Default Configuration

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration

BentoML has a Path Traversal via Bentofile Configuration

React Server Components have multiple Denial of Service Vulnerabilities

Microsoft Office Security Feature Bypass Vulnerability