Advisory Catalog

mcp-server-kubernetes has potential security issue in exec_in_pod tool

This module enables you to apply time-based login restrictions and display related warning or logout confirmation pages. The module doesn't sufficiently protect its confirmation routes from cross-site request forgery (CSRF), allowing the logout confirmation route to be triggered without user intera

Claude Code Command Validation Bypass Allows Arbitrary Code Execution

Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors

GrapesJsBuilder File Upload allows all file uploads

Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Django is vulnerable to DoS via XML serializer text extraction

vLLM vulnerable to remote code execution via transformers_utils/get_config

Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter

Grav Exposes Password Hashes Leading to privilege escalation

Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions

Grav is vulnerable to Arbitrary File Read

Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)

Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms

Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection

Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls

trytond does not enforce access rights for the route of the HTML editor.

Duplicate Advisory: Keras keras.utils.get_file API is vulnerable to a path traversal attack

Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements

Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

node-forge has ASN.1 Unbounded Recursion

OneUptime Unauthorized User Creation via API

Valibot has a ReDoS vulnerability in `EMOJI_REGEX`

Better Auth Passkey Plugin allows passkey deletion through IDOR

Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer

node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization

REDAXO CMS is vulnerable to RCE attack through its template management component

Keylime allows users to register new agents by recycling existing UUIDs when using different TPM devices

authkit-nextjs may let session cookies be cached in CDNs

@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes

vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

vLLM deserialization vulnerability leading to DoS and potential RCE

LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter

Claude Code vulnerable to command execution prior to startup trust dialog

Astro vulnerable to reflected XSS via the server islands feature

cbor2 C extension decoder flaws can cause denial of service

Fortinet FortiWeb OS Command Injection Vulnerability

Google Chromium V8 Type Confusion Vulnerability

glob CLI: Command injection via -c/--cmd executes matches with shell:true

phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality

OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

Apollo Federation has Improper Enforcement of Access Control on Transitive Fields

Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change

Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)