Advisory Catalog

Browsershot Improper Input Validation vulnerability

Atro CSRF Middleware Bypass (security.checkOrigin)

Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo

PGHoard Path Traversal vulnerability

D-Tale allows Remote Code Execution through the Custom Filter Input

Browsershot Local File Inclusion

Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

Open Social is a Drupal distribution for online communities, which ships with a default (optional) module social\_file\_private to ensure the images and files provided by the distribution are stored in the private instead of the public filesystem. For installations of Open Social prior to version 1

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page. The Login Disable module does not correctly prevent a user with a disabled login from logging in, allowing those users to by-pass t

pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion

Trix editor subject to XSS vulnerabilities on copy & paste

Apache Superset: Error verbosity exposes metadata in analytics databases

Predictable results in nanoid generation when given non-integer values

LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section

Directus has an HTML Injection in Comment

Firepad allows insecure document access

This module allows a site builder to create multi-step entity forms leveraging the Field Group field type plugins. The module doesn't escape plain text administrative configurations. An attacker with admin access could inject arbitrary JavaScript code. This vulnerability is mitigated by the fact t

The Minify JS module allows a site administrator to minify all javascript files that exist in the site's code base and use those minified files on the front end of the website. Several administrator routes are unprotected against Cross-Site Request Forgery (CRSF) attacks.

This module provides a field formatter for the field type 'file' called `Table of files with download all link` . The module had vulnerabilities allowing a user to download files they normally should not be able to download.

Module to restrict access from anonymous and regular users to configured pre-defined pages. The module does not adequately handle protecting certain types of URLs.

This module enables you to authenticate users through an Identity Provider (IdP) or OAuth Server, allowing them to log in to your Drupal site. The module does not sufficiently escape query parameters sent to the callback URL when displaying error messages, particularly if the code parameter is miss

Synapse Matrix has a partial room state leak via Sliding Sync

Synapse's unauthenticated writes to the media repository allow planting of problematic content

Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality

ibexa/post-install affected by Breach with Varnish VCL

ibexa/http-cache affected by Breach with Varnish VCL

ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL

Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Ibexa Admin UI vulnerable to Cross-site Scripting in a field that is used in the Content name pattern

@intlify/shared Prototype Pollution vulnerability

vue-i18n has cross-site scripting vulnerability with prototype pollution

pyspider Cross-site Scripting vulnerability

This module integrates Tarte au citron JS library with Drupal and prevent services to be loaded without user consent. Administrators can enable and configure services which will be managed by Tarte au citron. When Google Tag Manager (GTM) service is enabled, an attacker can load a GTM container tha

TCPDF Local File Inclusion vulnerability

smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables

Sentry improper error handling leaks Application Integration Client Secret

A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bounds read and potential application crash.

This module for Drupal provides complete control of Email settings with Drupal and Mailjet. In certain cases the module doesn't securely pass data to PHP's unserialize() function, which could result in Remote Code Execution via PHP Object Injection. This vulnerability is mitigated by the fact that

Drupal Core Cross-Site Scripting (XSS)

django CMS Attributes Field Cross-site Scripting

Django Filer Unrestricted Upload of File with Dangerous Type

Moodle IDOR when accessing list of course badges

Moodle Lesson activity password bypass through PHP loose comparison

Moodle allows users to retrieve information they did not have permission to access

Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

Statamic CMS has a Path Traversal in Asset Upload

Redaxo Core CMS Cross Site Scripting (XSS)

Linux Kernel Use of Uninitialized Resource Vulnerability

aiohttp allows request smuggling due to incorrect parsing of chunk extensions