Advisory Catalog

OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the `external` flag on/off and change

Vite's server.fs.deny bypassed with /. for files under project root

Auth0 NextJS SDK v4 Missing Session Invalidation

AngularJS improperly sanitizes SVG elements

@account-kit/smart-contracts Allowlist Module Bypass Vulnerability

YesWiki Stored XSS Vulnerability in Comments

Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting

Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

n8n Vulnerable to Stored XSS through Attachments View Endpoint

Moodle allows IDOR when accessing the cohorts report

Moodle has an IDOR in messaging web service which allows access to some user details

Moodle's AJAX section delete does not respect course_can_delete_section()

Moodle has reflected Cross-site Scripting risk in policy tool

Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users

Moodle allows IDOR in RSS block, which allows access to additional RSS feeds

Moodle reveals student identities through assignment submissions search on anonymous submissions

Moodle makes some user data available before completing second factor with MFA enabled

Moodle shows hidden grades to users without permission on some grade reports

GraphQL Armor Cost-Limit Plugin Bypass via Introspection Query Obfuscation

Moodle self enrollment available before completing second factor with MFA enabled

This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability is mitigated by the fact that a site admin would have to perform further steps after

Block Class enables you to add custom attributes to blocks. The module did not sufficiently sanitize custom attribute input, allowing for potential XSS attacks when malicious JavaScript was injected as a custom attribute. This vulnerability is mitigated by the fact that an attacker must have a rol

This module enables you to put a site wide bootstrap themed alert message on the top of every page. The module doesn't sufficiently filter text input when leading to a possible XSS attacks. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administe

Colorbox is a module that allows Images, and iframed or inline content to be displayed in a modal above the current page. The Colorbox module doesn't sufficiently sanitize data attributes before opening modals. This vulnerability is mitigated by the fact that an attacker must have a role with perm

pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

Laravel Starter Cross Site Scripting (XSS)

OctoPrint Authenticated Reverse Proxy Page Authentication Bypass

QMarkdown Cross-Site Scripting (XSS) vulnerability

Rasa Pro Missing Authentication For Voice Connector APIs

PEAR HTTP_Request2 vulnerable to Cross-site Scripting

PyTorch Improper Resource Shutdown or Release vulnerability

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

Stage File Proxy is a general solution for getting production files on a development server on demand. The module doesn't sufficiently validate the existence of remote files prior to attempting to download and create them. An attacker could send many requests and exhaust disk resources. This vulne

The baguetteBox.js module provides integration with baguetteBox.js library. The module doesn't sufficiently sanitize user-supplied text values leading to a cross site scripting vulnerability.

Permission policy information leakage in Backstage permission system

vLLM vulnerable to Denial of Service by abusing xgrammar cache

jquery-validation vulnerable to Cross-site Scripting

http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

http-proxy-middleware can call writeBody twice because "else if" is not used

@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params

Formie has XSS vulnerability for importing forms

Formie has XSS vulnerability for email notification content for preview

Silverstripe Framework user enumeration via timing attack on login and password reset forms

Yii does not prevent XSS in scenarios where fallback error renderer is used