Advisory Catalog

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

Windows ML CLI: CORS misconfig enables localhost RCE

fast-uri vulnerable to authority injection via an unvalidated port in serialize

HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

TOON: Prototype pollution when decoding untrusted TOON input

This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A [separate PHP fatal error issue](https://www.drupal.org/project/webform_submissions_delete/issues/3396717) may prevent exploitation in p

This module creates permissions per node content type to control access to unpublished content. The module has allowed view access for published content, overriding other access mechanisms that might have been in place.

This module enables you to add dynamic caption support to PhotoSwipe image galleries. The module doesn't sufficiently sanitize user-supplied input (such as image alt tags) in its dynamic caption script, leading to a Cross-Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the f

The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks.

A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Media

This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports > Mail log. The module doesn't sufficiently redact the content of the emails it logs. Account related emails are stored with their one-time login links intact, so any user who can v

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest.

This `islandora_advanced_search` sub module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to r

This module enables you to add an extra layer of verification for user registration. The module doesn't sufficiently filter user-supplied input before output, resulting in an unauthenticated reflected Cross-site Scripting (XSS) vulnerability.

This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability.

This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently validate user input before passing to token replacement. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts.