Advisory Catalog

HashiCorp Vagrant has code injection vulnerability through default synced folders

Microweber CMS API has authenticated local file inclusion vulnerability

This module enables you to use [config\_pages](https://www.drupal.org/project/config_pages) as a content entity. The module doesn't check permission or entity access before rendering config\_pages content.

This module enables you to allow and/or require a second authentication method in addition to password authentication. The module does not sufficiently ensure that users with enhanced privileges are prevented from viewing recovery codes of other users. This vulnerability is mitigated by the fact t

juju/utils leaks private key in certs

Electron vulnerable to Heap Buffer Overflow in NativeImage

Mattermost Incorrect Authorization vulnerability

Mattermost Incorrect Authorization vulnerability

File Browser vulnerable to insecure password handling

File Browser allows sensitive data to be transferred in URL

HKUDS LightRAG allows Path Traversal via function upload_to_input_dir

mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data

filebrowser Sets Insecure File Permissions

Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling

OpenBao allows cancellation of root rekey and recovery rekey operations without authentication

OpenBao Inserts Sensitive Information into Log File when processing malformed data

n8n allows open redirects via the /signin endpoint

Gogs XSS allowed by stored call in PDF renderer

iOS Simulator MCP Command Injection allowed via exec API

Project Paragraphs table provides a field for a collection table. The module doesn't sufficiently sanitise certain data attributes allowing Cross Site Scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containin

[Simple XML sitemap](https://www.drupal.org/project/simple_sitemap) is a SEO module that allows creating various XML sitemaps of the site's content and submitting them to search engines. The module doesn't sufficiently sanitize input when administering it, which leads to a Cross-site scripting (XS

The module enables you to add second-factor authentication on top of the default Drupal login. The module does not sufficiently ensure that known authorization routes are protected. This vulnerability is mitigated by the fact that an attacker must obtain the user's username and password.

The CKEditor5 Youtube module enhances content creation in Drupal by seamlessly integrating YouTube video embedding into the CKEditor 5 text editor. The module doesn't sufficiently validate iframe sources under the scenario where a user embeds a video using the CKEditor YouTube integration leading t

Klaro Cookie & Consent Management module is used for consent management for cookies and external sources. It makes changes to the markup to enable or disable loading. The module doesn't sufficiently sanitize some HTML attributes allowing persistent Cross-site Scripting (XSS) attacks. This vulnerab

GLightbox module is a pure Javascript lightbox for CKEditor. The module doesn't sufficiently filter user-supplied text for the GLightbox Javascript library leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the

This module enables you to generate Table of content of your pages given a configuration. The module doesn't sufficiently sanitise data attributes allowing persistent Cross-site Scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission t

Magento Security feature bypass

Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter

MLFlow SSRF via gateway_proxy_handler

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

Mattermost allows unauthorized channel member management through playbook runs

Mattermost allows an unauthorized Guest user access to Playbook

Velociraptor vulnerable to privilege escalation via UpdateConfig artifact

urllib3 does not control redirects in browsers and Node.js

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer

OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal

Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function

python-a2a has a path traversal in the create_workflow function

Apple Multiple Products Unspecified Vulnerability

New authd users logging in via SSH are members of the root group

Weblate lacks rate limiting when verifying second factor

Ibexa RichText Field Type XSS vulnerabilities in back office

Ibexa Admin UI XSS vulnerabilities in back office

Ibexa Admin UI assets XSS vulnerabilities in back office

Ibexa eZ Platform Admin UI assets XSS vulnerabilities in back office

Ibexa eZ Platform Admin UI XSS vulnerabilities in back office

A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.

Salt's worker process vulnerable to denial of service through file read operation