Advisory Catalog

ReLaXed Cross-site Scripting vulnerability

Inefficient Regular Expression Complexity in langflow

Agnai vulnerable to Relative Path Traversal in Image Upload

Agnai File Disclosure Vulnerability: JSON via Path Traversal

Layui has DOM Clobbering gadgets that leads to Cross-site Scripting

Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function.

IDOR vulnerability in account profile page

Cross-site scripting (XSS) in the clipboard package

Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting

Cross site scripting in Concrete CMS

Cross site scripting in Concrete CMS

A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated user can inject arbitrary JavaScript or HTML into the "Top banner" field. NOTE: Multiple third parties h

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All supp

Prevent XSS from Confidant API call

DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS

Reverb use after free vulnerability

Mautic allows users enumeration due to weak password login

Mautic has an XSS in contact tracking and page hits report

Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field)

Mautic vulnerable to XSS in contact/company tracking (no authentication)

Directus vulnerable to SSRF Loopback IP filter bypass

@backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Concrete CMS stored XSS vulnerability in the "Top Navigator Bar" block

Heap-based Buffer Overflow in MicroPython

Use After Free in MicroPython

heap-buffer-overflow in MicroPython

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content

vLLM Denial of Service via the best_of parameter

Contao affected by insert tag injection via canonical URL

Contao affected by directory traversal in the file selector widget

Concrete CMS Stored XSS in the "Next&Previous Nav" block

Mattermost Desktop App fails to sufficiently configure Electron Fuses

Mattermost Desktop App fails to safeguard screen capture functionality

Composio Path Traversal vulnerability

Composio Code Injection Vulnerability

Aim Stored XSS through TEXT EXPLORER

D-Tale Command Execution Vulnerability

Withdrawn Advisory: Lunary information disclosure vulnerability

whatsapp-api-js fails to validate message's signature

MindsDB Cross-site Scripting vulnerability

Sensitive Information Exposure Through Insecure Logging For Secrets Like Metadata.DockerBuildArgs

AWS SageMaker Training Toolkit logs CodeArtifact Authorization token

This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers. The module doesn't sufficiently validate input in Content Security Policy (CSP) violation reports. This can cause errors when a logging module (e.g. dblog or sysl

Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability

auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

serve-static vulnerable to template injection that can lead to XSS

send vulnerable to template injection that can lead to XSS

express vulnerable to XSS via response.redirect()