Advisory Catalog

Cockpit - Content Platform vulnerable to XSS through name or email argument names

n8n is vulnerable to Improper Authorization through its `/stop` endpoint

tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

n8n Vulnerable to Denial of Service via Malformed Binary Data Requests

Microweber CMS API has authenticated local file inclusion vulnerability

This module enables you to use [config\_pages](https://www.drupal.org/project/config_pages) as a content entity. The module doesn't check permission or entity access before rendering config\_pages content.

This module enables you to allow and/or require a second authentication method in addition to password authentication. The module does not sufficiently ensure that users with enhanced privileges are prevented from viewing recovery codes of other users. This vulnerability is mitigated by the fact t

Electron vulnerable to Heap Buffer Overflow in NativeImage

HKUDS LightRAG allows Path Traversal via function upload_to_input_dir

n8n allows open redirects via the /signin endpoint

iOS Simulator MCP Command Injection allowed via exec API

Project Paragraphs table provides a field for a collection table. The module doesn't sufficiently sanitise certain data attributes allowing Cross Site Scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containin

[Simple XML sitemap](https://www.drupal.org/project/simple_sitemap) is a SEO module that allows creating various XML sitemaps of the site's content and submitting them to search engines. The module doesn't sufficiently sanitize input when administering it, which leads to a Cross-site scripting (XS

The module enables you to add second-factor authentication on top of the default Drupal login. The module does not sufficiently ensure that known authorization routes are protected. This vulnerability is mitigated by the fact that an attacker must obtain the user's username and password.

The CKEditor5 Youtube module enhances content creation in Drupal by seamlessly integrating YouTube video embedding into the CKEditor 5 text editor. The module doesn't sufficiently validate iframe sources under the scenario where a user embeds a video using the CKEditor YouTube integration leading t

Klaro Cookie & Consent Management module is used for consent management for cookies and external sources. It makes changes to the markup to enable or disable loading. The module doesn't sufficiently sanitize some HTML attributes allowing persistent Cross-site Scripting (XSS) attacks. This vulnerab

GLightbox module is a pure Javascript lightbox for CKEditor. The module doesn't sufficiently filter user-supplied text for the GLightbox Javascript library leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the

This module enables you to generate Table of content of your pages given a configuration. The module doesn't sufficiently sanitise data attributes allowing persistent Cross-site Scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission t

Magento Security feature bypass

Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter

MLFlow SSRF via gateway_proxy_handler

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

urllib3 does not control redirects in browsers and Node.js

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer

Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function

python-a2a has a path traversal in the create_workflow function

Apple Multiple Products Unspecified Vulnerability

Weblate lacks rate limiting when verifying second factor

Ibexa RichText Field Type XSS vulnerabilities in back office

Ibexa Admin UI XSS vulnerabilities in back office

Ibexa Admin UI assets XSS vulnerabilities in back office

Ibexa eZ Platform Admin UI assets XSS vulnerabilities in back office

Ibexa eZ Platform Admin UI XSS vulnerabilities in back office

A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.

Salt's worker process vulnerable to denial of service through file read operation

Salt's file contents overwrite the VirtKey class

Salt allows arbitrary directory creation or file deletion

Salt vulnerable to directory traversal attack in minion file cache creation

Salt's on demand pillar functionality vulnerable to arbitrary command injections

Salt's salt.auth.pki module does not properly authenticate callers

starcitizentools/citizen-skin allows stored XSS in menu heading message

starcitizentools/citizen-skin allows stored XSS in user registration date message

starcitizentools/citizen-skin allows stored XSS in preference menu heading messages

starcitizentools/citizen-skin allows stored XSS in search no result messages

pg-promise SQL Injection vulnerability

Citizen skin vulnerable to stored XSS through multiple system messages

Erxes Path Traversal vulnerability

Nautobot may allows uploaded media files to be accessible without authentication

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating