Advisory Catalog

Denial of Service Vulnerability in React Server Components

Next Vulnerable to Denial of Service with Server Components

FoF Pretty Mail has a server-side template injection vulnerability

Denial of Service Vulnerability in React Server Components

Servify-express rate limit issue

gardenctl is vulnerable to Command Injection when used with non‑POSIX shells

1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality

Formio improperly authorized permission elevation through specially crafted request path

1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username functionality

This module provides a centralized content distribution and syndication solution so thta customers can publish, reuse, and syndicate content across a network of Drupal websites. The module doesn't sufficiently protect export routes from cross-site request forgery (CSRF) attacks, potentially allowin

Gogs vulnerable to a bypass of CVE-2024-55947

LangGraph's SQLite is vulnerable to SQL injection via metadata filter key in SQLite checkpointer list method

Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability

Microsoft Windows Use After Free Vulnerability

Shopware Storefront Reflected XSS in Storefront Login Page

Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE)

Filament multi-factor authentication (app) recovery codes can be used multiple times

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin

SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE

RCE via ZipSlip and symbolic links in argoproj/argo-workflows

Elysia affected by arbitrary code injection through cookie config

NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read

Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers

ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login

ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login

memos vulnerability allows the creation of arbitrary accounts

robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation

1Panel – CAPTCHA Bypass via Client-Controlled Flag

Android Framework Privilege Escalation Vulnerability

Sigstore Timestamp Authority allocates excessive memory during request parsing

Fulcio allocates excessive memory during token parsing

urllib3 streaming API improperly handles highly compressed data

urllib3 allows an unbounded number of links in the decompression chain

Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'

Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web

Logrus is vulnerable to DoS when using Entry.Writer()

auth0/node-jws Improperly Verifies HMAC Signature

ComposioHQ has a directory traversal vulnerability

mcp-server-kubernetes has potential security issue in exec_in_pod tool

This module enables you to apply time-based login restrictions and display related warning or logout confirmation pages. The module doesn't sufficiently protect its confirmation routes from cross-site request forgery (CSRF), allowing the logout confirmation route to be triggered without user intera

Coder logs sensitive objects unsanitized

Claude Code Command Validation Bypass Allows Arbitrary Code Execution

Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode

Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors

gokey allows secret recovery from a seed file without the master password

GrapesJsBuilder File Upload allows all file uploads

Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Django is vulnerable to DoS via XML serializer text extraction

Gin-vue-admin has an arbitrary file deletion vulnerability