Advisory Catalog

Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass

Rancher update on users can deny the service to the admin

Rancher CLI SAML authentication is vulnerable to phishing attacks

Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies

Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles

Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters

An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor.

A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS).

A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS).

A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).

pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.

Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability

An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation.

apidoc-core is vulnerable to prototype pollution

dref is vulnerable to prototype pollution

Withdrawn Advisory: fast-redact vulnerable to prototype pollution

csvjson vulnerable to prototype injection

web3-core-method is vulnerable to prototype pollution

toggle-array vulnerable to prototype pollution

spmrc vulnerable to prototype pollution

sassdoc-extras vulnerable to prototype pollution

rollbar vulnerable to prototype pollution

mpregular vulnerable to prototype pollution

Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes

messageformat has a prototype pollution vulnerability

web3-core-subscriptions has a Prototype Pollution vulnerability

Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

CSVTOJSON has a prototype pollution vulnerability

Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink

CodeChecker has a buffer overflow in the log command

`git-comiters` Command Injection vulnerability

Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

Mattermost Path Traversal vulnerability

Codex has sandbox bypass due to bug in path configuration logic

Keras is vulnerable to Deserialization of Untrusted Data

The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.

Snipe-IT allows unsafe deserialization

DragonFly's manager generates mTLS certificates for arbitrary IP addresses

Dragonfly vulnerable to server-side request forgery

Dragonfly doesn't have authentication enabled for some Manager’s endpoints

esm.sh has File Inclusion issue

Podman Creates Temporary File with Insecure Permissions

@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode

FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability

Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults

Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function

Mattermost Open Redirect vulnerability