Advisory Catalog

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been p

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

Satori-generated SVG has improper escaping

Astro: Netlify Image CDN allowlist bypass enables SSRF

Nest: Unbounded memory growth in the NestJS TCP microservice transport

adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Electron: Local race condition in Squirrel.Mac update installation on macOS

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

urllib3: Chunked Deflate streaming can enter an infinite loop

Werkzeug safe_join() allows Windows special device names

Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.snowflakecomputing.com/api/v2/statements`, so an `account` value containing `/`, `?` or `#` demotes the

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clau

pbkdf2 rehashes long passwords on every iteration, enabling denial of service

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Axios: Header Injection via Inherited headers After Minimal Interceptor

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption

xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

social-auth-core has a Session Fixation issue

social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

social-auth-core has an Improper Authentication issue

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. This

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through t

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the `/css-usage-analyzer/save` endpoint against forged or repeated submissions.