Advisory Catalog

Argo Workflows affected by stored XSS in the artifact directory listing

phpPgAdmin contains a remote command execution vulnerability

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF metadata

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder

Seroval affected by Denial of Service via Array serialization

seroval affected by Denial of Service via RegExp serialization

@envelop/graphql-modules has a Race Condition vulnerability

sm-crypto Affected by Signature Forgery in SM2-DSA

sm-crypto Affected by Signature Malleability in SM2-DSA

seroval Affected by Remote Code Execution via JSON Deserialization

SiYuan vulnerable to Arbitrary file Read / SSRF

SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality

Wrangler affected by OS Command Injection in `wrangler pages deploy`

Fleet has an Access Control vulnerability in debug/pprof endpoints

esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages

Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered

Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

Chainlit contain a server-side request forgery (SSRF) vulnerability

Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element id

ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion

@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

Fastify Middie Middleware Path Bypass

WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

Skipper is vulnerable to arbitrary code execution through lua filters

svelte is vulnerable to XSS with textarea bind:value

GraphQL Modules has a Race Condition issue

ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection

pyasn1 has a DoS vulnerability in decoder

Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

Apache Airflow proxy credentials for various providers might leak in task logs

Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated

alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass

devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)

Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse

SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering

DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface

Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter

Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)

Pimcore Has an Incomplete Patch for CVE-2023-30848

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

This module allows site administrators to grant specific roles the authority to assign selected roles to users, without them needing the "administer permissions" permission. The module contains an access bypass vulnerability when used in combination with the Views Bulk Operations module. A user wit

Shopware Has Improper Control of Generation of Code in Twig rendered views

html2pdf.js contains a cross-site scripting vulnerability

go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message

go-ethereum is vulnerable to DoS via malicious p2p message affecting a vulnerable node

jaraco.context Has a Path Traversal Vulnerability