Advisory Catalog

MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

Apple Multiple Products Classic Buffer Overflow Vulnerability

Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component

Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components

Tornado vulnerable to Header Injection and XSS via reason argument

Next Server Actions Source Code Exposure

Source Code Exposure Vulnerability in React Server Components

Improper Validation of Query Parameters in Auth0 Next.js SDK

Improper Request Caching Lookup in the Auth0 Next.js SDK

Pyrofork has a Path Traversal in download_media Method

HTTP/HTTPS Traffic Interception Bypass in mad-proxy

Open Redirect Vulnerability in Taguette

NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

Android Framework Information Disclosure Vulnerability

Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

open-webui is Vulnerable to Incorrect Access Control

Ansible Community General Collection is vulnerable to exposure of sensitive information

alexusmai laravel-file-manager is vulnerable to Directory Traversal

This module enables you to disable the standard Drupal login form (`/user/login`) so site owners can prevent interactive logins via the UI. The module does not sufficiently block authentication when the REST/HTTP login route is used. An attacker (or legitimate user) with valid credentials can authe

This module enables you to deploy content from one Drupal website to another. The module provides some default configuration without sufficient access control. This vulnerability is mitigated by the fact that an administrator can add some default access control permission.

This module enables integration between Next.js and Drupal for headless CMS functionality. When installed, the module automatically enables cross-origin resource sharing (CORS) with insecure default settings (`Access-Control-Allow-Origin: *`), overriding any `services.yml` CORS configuration. This

This module enables you to use the Tagify library to enhance text input fields with tag-style UI elements. The module does not sufficiently sanitize the `infoLabel` value under certain configurations, which can result in a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated b

This modules provides the ability to chat with an AI Agent using a large-language model (LLM) provider for different purposes. The module doesn’t sufficiently filter LLM responses. This leads to a cross-site scripting (XSS) vulnerability where an attacker can use prompt injections on user-generated

The module provides instant integration of the official CKEditor 5 Premium plugins into the Drupal editor configuration. This module has a path traversal vulnerability, which allows an access bypass to restricted image files in the system. This access bypass is possible for any account with a *Vie

This module allows uploading a zip file and extracting its content in the public file directory to serve this content from a Drupal website. These zip files may contain arbitrary HTML or SVG content that could allow cross-site scripting vulnerabilities. While this is an expected feature, the module

FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management

arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints

Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor

Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments

Django is vulnerable to SQL injection in column aliases

fastify-reply-from affected by bypass of reply forwarding

Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host

mdast-util-to-hast has unsanitized class attribute

Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`

Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters

Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab

Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`

Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure

Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel

Grav is vulnerable to a DOS on the admin panel

Grav vulnerable to Path Traversal allowing server files backup

Snipe-IT allows stored XSS via the Locations "Country" field

Snipe-IT is vulnerable to stored cross-site scripting

FeehiCMS fails to enforce server-side immutability

FeehiCMS is vulnerable to reverse tabnabbing

FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function

trytond does not enforce access rights for data export

trytond allows remote attackers to obtain sensitive trace-back (server setup) information