Advisory Catalog

phpMyFAQ: Public API endpoints expose emails and invisible questions

protobuf affected by a JSON recursion depth bypass

Moodle affected by a code injection vulnerability

Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Orval Mock Generation Code Injection via const

Sentencepiece has a a heap overflow issue

orjson does not limit recursion for deeply nested JSON documents

Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass

Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

Seroval affected by Denial of Service via Deeply Nested Objects

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

phpPgAdmin contains a remote command execution vulnerability

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF metadata

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder

Seroval affected by Denial of Service via Array serialization

seroval affected by Denial of Service via RegExp serialization

@envelop/graphql-modules has a Race Condition vulnerability

sm-crypto Affected by Signature Forgery in SM2-DSA

sm-crypto Affected by Signature Malleability in SM2-DSA

seroval Affected by Remote Code Execution via JSON Deserialization

Wrangler affected by OS Command Injection in `wrangler pages deploy`

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

Chainlit contain a server-side request forgery (SSRF) vulnerability

Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element id

ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion

@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

Fastify Middie Middleware Path Bypass

WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

svelte is vulnerable to XSS with textarea bind:value

GraphQL Modules has a Race Condition issue

pyasn1 has a DoS vulnerability in decoder

Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

Apache Airflow proxy credentials for various providers might leak in task logs

Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated

alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass

devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)

Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse

SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering

Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter

Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)

Pimcore Has an Incomplete Patch for CVE-2023-30848

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

This module allows site administrators to grant specific roles the authority to assign selected roles to users, without them needing the "administer permissions" permission. The module contains an access bypass vulnerability when used in combination with the Views Bulk Operations module. A user wit

Shopware Has Improper Control of Generation of Code in Twig rendered views

html2pdf.js contains a cross-site scripting vulnerability

jaraco.context Has a Path Traversal Vulnerability

GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE