Advisory Catalog

Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form.

This module enables you to automatically translate entities. The module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access level than the paren

This submodule AI Translate enables you to automatically translate entities. The module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access leve

This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module doesn't sufficiently sanitize for cross site scripting (XSS) when using the structured results using legacy agent setups. This vulnerability is mitigated by the fact that an attac

This module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn’t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block content.

Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Apache Spark History Server allows stored cross-site scripting through unescaped application names

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

SonicWall SMA1000 Appliances OS Command Injection Vulnerability

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

SVGO: removeScripts allows executable links through namespace and control-character bypasses

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

joi: Prototype pollution via a `__proto__` language key in custom messages

joi: object().rename() with a template target can set the validated object's prototype

Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Composer arbitrary command execution via a malicious package's Perforce source URL

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

pypdf: Possible long runtimes/large memory usage when retrieving outlines

league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

league/commonmark: Denial of service in the SmartPunct and Attributes extensions

league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

pypdf: Possible infinite loop for TreeObject.insert_child

phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

Filament: Password validity disclosure for accounts denied panel access on login page