Advisory Catalog

Fedify has ReDoS Vulnerability in HTML Parsing Regex

KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm

Kimai contains a SameSite cookie vulnerability

FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

External Control of File Name or Path in Langflow

Langflow vulnerable to Server-Side Request Forgery

MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability

Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments

Weblate has an arbitrary file read via symbolic links

tinacms is vulnerable to arbitrary code execution

Storybook manager bundle may expose environment variables during build

nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

Apple Multiple Products Use-After-Free WebKit Vulnerability

Auth0-PHP SDK has Improper Audience Validation

Http Client Manager introduces a new Guzzle based plugin which allows you to manage HTTP clients using Guzzle Service Descriptions via YAML, JSON or PHP files, in a simple and efficient way. The modules allows administrators to configure HTTP requests as part of Event Condition Action (ECA) automati

Expr has Denial of Service via Unbounded Recursion in Builtin Functions

SIPGO is Vulnerable to Response DoS via Nil Pointer Dereference

Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits

Libredesk has Improper Neutralization of HTML Tags in a Web Page

@vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint

systeminformation has a Command Injection vulnerability in fsSize() function on Windows

Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter

tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References

Fickling has Code Injection vulnerability via pty.spawn()

Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list

misskey.js's export data contains private post data

Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access

Universal Tool Calling Protocol (UTCP) client library for Python vulnerable to Trust Boundary Violation through Manual JSON specification

Apple Multiple Products Improper Locking Vulnerability

Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule

Vuetify has a Prototype Pollution vulnerability

Google Chromium Out of Bounds Memory Access Vulnerability

Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration

NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)

Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip

Weaviate OSS has path traversal vulnerability via the Shard Movement API

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

Vite Plugin React has a Denial of Service Vulnerability in React Server Components

Tornado: Quadratic DoS via Crafted Multipart Parameters

Tornado: Quadratic DoS via Repeated Header Coalescing

Denial of Service Vulnerability in React Server Components

Next Vulnerable to Denial of Service with Server Components

FoF Pretty Mail has a server-side template injection vulnerability

Denial of Service Vulnerability in React Server Components

Servify-express rate limit issue

gardenctl is vulnerable to Command Injection when used with non‑POSIX shells