Advisory Catalog

Mattermost Confluence Plugin is Missing Authentication for Critical Function

Mattermost Confluence Plugin has Missing Authorization vulnerability

Mattermost Confluence Plugin has Missing Authorization vulnerability

Mattermost Confluence Plugin has Missing Authorization vulnerability

TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)

Oak Server has ReDoS in x-forwarded-proto and x-forwarded-for headers

Craft CMS has a theoretical bypass for CVE-2025-23209

OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse

OpenBao TOTP Secrets Engine Code Reuse

OpenBao Userpass and LDAP User Lockout Bypass

operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

uv allows ZIP payload obfuscation through parsing differentials

Astros's duplicate trailing slash feature leads to an open redirection security issue

Ollama allows deletion of arbitrary files

The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended

tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter

HashiCorp Vault ldap auth method may not have correctly enforced MFA

Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability

Shopware race condition bypasses voucher restrictions

Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page

FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

IPX Allows Path Traversal via Prefix Matching Bypass

Grafana Infinity Datasource Plugin SSRF Vulnerability

Hashicorp Vault has Lockout Feature Authentication Bypass

Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse

Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability

Hashicorp Vault has Incorrect Validation for Non-CA Certificates

Microweber has Reflected XSS Vulnerability in the layout Parameter

Microweber has Reflected XSS Vulnerability in the id Parameter

php-jwt contains weak encryption

MaterialX Lack of MTLX Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion

MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit

OpenEXR Out-Of-Memory via Unbounded File Header Values

OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

OpenEXR Out of Bounds Heap Read due to Bad Pointer Arithmetic in LossyDctDecoder_execute

MS SWIFT Deserialization RCE Vulnerability

MS SWIFT WEB-UI RCE Vulnerability

copyparty Reflected XSS via Filter Parameter

This module enables you to integrate Google Tag Manager (GTM) into your Drupal site by allowing administrators to configure and embed GTM container snippets. The module doesn't sufficiently sanitize the GTM container ID under the scenario where a user with the *Administer gtm* permission enters mal

OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0

Ruby SAML DOS vulnerability with large SAML response

Pyload log Injection via API /json/add_package in add_name parameter

Moby firewalld reload makes published container ports accessible from remote hosts

Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs

copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata

webfinger.js Blind SSRF Vulnerability

Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter

Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code

Calibre Web and Autocaliweb have OS Command Injection vulnerability