Advisory Catalog

OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

OctoPrint vulnerable to possible file extraction via upload endpoints

Magento Improper Access Control leads to security feature bypass

@vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability

taro-css-to-react-native Regular Expression Denial of Service vulnerability

@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability

Requests vulnerable to .netrc credentials leak via malicious URLs

HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

Yii 2 Redis may expose AUTH parameters in logs in case of connection failure

IGEL OS Use of a Key Past its Expiration Date Vulnerability

Django Improper Output Neutralization for Logs vulnerability

AngularJS Incomplete Filtering of Special Elements vulnerability

webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

webpack-dev-server users' source code may be stolen when they access a malicious web site

Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint

SignXML's signature verification with HMAC is vulnerable to a timing attack

SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

juzaweb CMS allows cross-site scripting by uploading an SVG file

django-helpdesk Allows Sensitive Data Exposure

Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution

Gradio CORS Origin Validation Bypass Vulnerability

Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function

Markdownify MCP Server allows attackers to read arbitrary files

multicast in source builds from vulnerable setuptools dependency

vLLM Tool Schema allows DoS via Malformed pattern and type Fields

vLLM allows clients to crash the openai server with invalid regex

vLLM DOS: Remotely kill vllm over http with invalid JSON schema

vLLM vulnerable to Regular Expression Denial of Service

vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`

The "Simple Klaro" module adds the "Klaro! A Simple Consent Manager" to your website and allows you to configure it according to your needs in the Drupal backend. The module doesn't sufficiently sanitise data attributes allowing persistent Cross Site Scripting (XSS) attacks. This vulnerability is

This module addresses the General Data Protection Regulation (GDPR) and the EU Directive on Privacy and Electronic Communications. The module doesn't sufficiently verify whether "disabled JavaScript" entries are valid or correspond to actual scripts on the page. As a result, an attacker could injec

This module enables you to setup a repeating date rule that users can "book" different dates, allowing you to let users register for a variety of different things like conference rooms or guitar lessons. This module has a permission of "view booking" and "view booking contact" which allows you to v

Mautic has an Open Redirect vulnerability on user unlock path.

Mautic segment cloning doesn't have a proper permission check

Mautic allows user name enumeration due to response time difference on password reset form

Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure

TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability

TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

Mautic does not shield .env files from web traffic

Chrome PHP is missing encoding in `CssSelector`

Laravel Rest Api has a Search Validation Bypass

radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

pypickle Incorrect Privilege Assignment vulnerability

HumanSignal label-studio-ml-backend Deserialization of Untrusted Data vulnerability

pypickle unsafe deserialization vulnerability

A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The attac

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-