Advisory Catalog

TYPO3 CMS exposes sensitive information in an error message

TYPO3 CMS uses insufficient entropy when generating passwords

TYPO3 Bookmark Toolbar vulnerable to denial of service

TYPO3 CMS has an open‑redirect vulnerability

Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

SimStudioAI: A function in route.ts is vulnerable to Code Injection

sanitize-html is vulnerable to XSS through incomprehensive sanitization

xgrammar vulnerable to denial of service by huge enum grammar

secrets-store-sync-controller discloses service account tokens in logs

Presta Shop vulnerable to email enumeration

Memos Vulnerable to Path Traversal via the CreateResource Endpoint

Memos Vulnerable to Stored Cross-Site Scripting

Electron has ASAR Integrity Bypass via resource modification

Mautic Vulnerable to User Enumeration via Response Timing

Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add

Mautic vulnerable to secret data extraction via elfinder

Local Deep Research's API keys are stored in plain text

MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

Next.js Affected by Cache Key Confusion for Image Optimization API Routes

Next.js Content Injection Vulnerability for Image Optimization

Eventlet affected by HTTP request smuggling in unparsed trailers

Google Sign-In for Rails allowed redirect to protocol-relative URI

Meta Platforms WhatsApp Incorrect Authorization Vulnerability

github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks

AiondaDotCom mcp-ssh command injection vulnerability in SSH operations

Payload's SQLite adapter Session Fixation vulnerability

Payload does not invalidate JWTs after log out

github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives

Contao does not properly manage privileges for page and article fields

Contao can disclose sensitive information in the news module

Contao discloses sensitive information in the front end search index

Contao applies improper access control in the back end voters

NeuVector process with sensitive arguments lead to leakage

NeuVector has an insecure password storage and is vulnerable to rainbow attack

The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined wit

Kubernetes Nodes can delete themselves by adding an OwnerReference

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

This module enables you to protect individual pages with a password. The module doesn't limit the number of password attempts, making it vulnerable to brute force attacks. This vulnerability is mitigated by the fact that an attacker must know the protected page's URL. **CVSS risk score ([experime

This module enables you to to easily create and manage faceted search interfaces. The module doesn’t sufficiently filter certain user-provided text leading to a cross site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permissi

This module enables you to to easily create and manage faceted search interfaces. The module doesn't sufficiently check access to entities when they are displayed as facets. This vulnerability is mitigated by the fact that only sites that show facets with entity labels (like taxonomy terms) are af

Google Sign-In for Rails allowed redirects to malformed URLs

GraphQL Armor Max-Depth Plugin Bypass via fragment caching

GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation

traQ Allows Insertion of Sensitive Information into Log File

request-filtering-agent SSRF Bypass via HTTPS Requests to 127.0.0.1

mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

h2 allows HTTP Request Smuggling due to illegal characters in headers

Craft CMS Potential Remote Code Execution via Twig SSTI