Advisory Catalog

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection

SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mail: Email address spoofing via malformed RFC 2047 encoded-words

Windows ML CLI: CORS misconfig enables localhost RCE

fast-uri vulnerable to authority injection via an unvalidated port in serialize

HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

TOON: Prototype pollution when decoding untrusted TOON input

This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A [separate PHP fatal error issue](https://www.drupal.org/project/webform_submissions_delete/issues/3396717) may prevent exploitation in p

This module creates permissions per node content type to control access to unpublished content. The module has allowed view access for published content, overriding other access mechanisms that might have been in place.

This module enables you to add dynamic caption support to PhotoSwipe image galleries. The module doesn't sufficiently sanitize user-supplied input (such as image alt tags) in its dynamic caption script, leading to a Cross-Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the f

The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks.

A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Media

This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports > Mail log. The module doesn't sufficiently redact the content of the emails it logs. Account related emails are stored with their one-time login links intact, so any user who can v

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest.

This `islandora_advanced_search` sub module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to r

This module enables you to add an extra layer of verification for user registration. The module doesn't sufficiently filter user-supplied input before output, resulting in an unauthenticated reflected Cross-site Scripting (XSS) vulnerability.

This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability.

This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently validate user input before passing to token replacement. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts.

Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form.

This module enables you to automatically translate entities. The module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access level than the paren

This submodule AI Translate enables you to automatically translate entities. The module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access leve