Advisory Catalog

Picklescan missing detection when calling pytorch function torch._dynamo.guards.GuardBuilder.get

Picklescan missing detection when calling pytorch function torch.utils.bottleneck.__main__.run_cprofile

UnoPim has Broken Access Control

Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

@musistudio/claude-code-router has improper CORS configuration

vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder

UnoPim vulnerable to remote code execution through Arbitrary File upload

vllm API endpoints vulnerable to Denial of Service Attacks

x402 SDK vulnerable in outdated versions in resource servers for builders

Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source

Copier's safe template has arbitrary filesystem read/write access

Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code

HashiCorp go-getter Vulnerable to Symlink Attacks

Withdrawn Advisory: Python-Future Module Arbitrary Code Execution via Unintended Import of test.py

External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access

OliveTin OS Command Injection vulnerability

Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms

Magento Cross-site Scripting vulnerability

Magento has incorrect authorization issue that leads to arbitrary file system read

Magento Cross-Site Request Forgery (CSRF) vulnerability

Magento vulnerable to denial of service

content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

Komari vulnerable to 2FA Authentication Bypass

Komari vulnerable to Cross-site WebSocket Hijacking

PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter

Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions

Mattermost Confluence Plugin has Improper Validation of Specified Type of Input

Mattermost Confluence Plugin is Missing Authentication for Critical Function

Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality

The AuthKit Remix Library renders sensitive auth data in HTML

The AuthKit React Router Library rendered sensitive auth data in HTML

OpenBao Root Namespace Operator May Elevate Token Privileges

@fedify/fedify has Improper Authentication and Incorrect Authorization

RARLAB WinRAR Path Traversal Vulnerability

SKOPS Card.get_model happily allows arbitrary code execution

This module enables you to provide SEO analysis and recommendations for a given URL. The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery (SSRF) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the pe

Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder

RatPanel can perform remote command execution without authorization

js-toml Prototype Pollution Vulnerability

Claude Code echo command allowed bypass of user approval prompt for command execution

Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

Dassault Systèmes DELMIA Apriso Code Injection Vulnerability

copyparty allows Regex Denial of Service (ReDoS) in the upload listing

Hashicorp Vault has Privilege Escalation Vulnerability

1Panel agent certificate verification bypass leading to arbitrary command execution

Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution

Microweber XSS Vulnerability in the homepage Endpoint

pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement).

OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size

Microweber Has Stored XSS Vulnerability in User Profile Fields