Advisory Catalog

jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin

Decap CMS Cross Site Scripting (XSS) vulnerability

Indico vulnerable to Cross-Site Scripting via LaTeX math code

Indico may disclose unauthorized user details access via legacy API

Infrahub: Deleted and expired API tokens can still authenticate

TinyEnv: Inline comments not stripped properly in .env values

SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor

Element Plus Link component (el-link) implements insufficient input validation for the href attribute

YesWiki Cross Site Scripting vulnerability

copyparty: Sharing a single file does not fully restrict access to other files in source folder

TYPO3 CSV download feature information disclosure

TYPO3 backend modules have Broken Access Control

TYPO3 CMS exposes sensitive information in an error message

TYPO3 CMS uses insufficient entropy when generating passwords

TYPO3 Bookmark Toolbar vulnerable to denial of service

TYPO3 CMS has an open‑redirect vulnerability

Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

SimStudioAI: A function in route.ts is vulnerable to Code Injection

sanitize-html is vulnerable to XSS through incomprehensive sanitization

xgrammar vulnerable to denial of service by huge enum grammar

Presta Shop vulnerable to email enumeration

Electron has ASAR Integrity Bypass via resource modification

Mautic Vulnerable to User Enumeration via Response Timing

Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add

Mautic vulnerable to secret data extraction via elfinder

Local Deep Research's API keys are stored in plain text

MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

Next.js Affected by Cache Key Confusion for Image Optimization API Routes

Next.js Content Injection Vulnerability for Image Optimization

Eventlet affected by HTTP request smuggling in unparsed trailers

Meta Platforms WhatsApp Incorrect Authorization Vulnerability

AiondaDotCom mcp-ssh command injection vulnerability in SSH operations

Payload's SQLite adapter Session Fixation vulnerability

Payload does not invalidate JWTs after log out

Contao does not properly manage privileges for page and article fields

Contao can disclose sensitive information in the news module

Contao discloses sensitive information in the front end search index

Contao applies improper access control in the back end voters

The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined wit

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

This module enables you to protect individual pages with a password. The module doesn't limit the number of password attempts, making it vulnerable to brute force attacks. This vulnerability is mitigated by the fact that an attacker must know the protected page's URL. **CVSS risk score ([experime

This module enables you to to easily create and manage faceted search interfaces. The module doesn’t sufficiently filter certain user-provided text leading to a cross site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permissi

This module enables you to to easily create and manage faceted search interfaces. The module doesn't sufficiently check access to entities when they are displayed as facets. This vulnerability is mitigated by the fact that only sites that show facets with entity labels (like taxonomy terms) are af

GraphQL Armor Max-Depth Plugin Bypass via fragment caching

GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation

request-filtering-agent SSRF Bypass via HTTPS Requests to 127.0.0.1

mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

h2 allows HTTP Request Smuggling due to illegal characters in headers