Advisory Catalog

@nyariv/sandboxjs has Prototype Pollution vulnerability that may lead to RCE

GitProxy Hidden Commits Injection

GitProxy New Branch Approval Exploit

GitProxy Backfile Parsing Exploit

GitProxy Approval Bypass When Pushing Multiple Branches

This module enables you to access an edit page for a config page. The module doesn't sufficiently check the access permissions (`hook_ENTITY_TYPE_access()` wasn't taken into account). This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit ID config

Apple Multiple Products Buffer Overflow Vulnerability

Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output

Bacula-web SQL Injection Vulnerability

Bugsink path traversal via event_id in ingestion

z-push/z-push-dev SQL Injection Vulnerability

ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid

Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)

HAX CMS API Lacks Authorization Checks

Skops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time

Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution

NULL Pointer Dereference in µD3TN via non-singleton destination Endpoint Identifier allows remote attacker to reliably cause DoS

Calibre Web and Autocaliweb have a ReDoS vulnerability

eKuiper API endpoints handling SQL queries with user-controlled table names.

This module allows you to manage video media items using the COOKiES module (disabling external video elements). These elements will be enabled again, once the COOKiES banner is accepted. The module doesn't sufficiently check whether to convert "data-src" attributes to "src" when their value might

FastAPI Guard has a regex bypass

Withdrawn Advisory: bun vulnerable to OS Command Injection

files-bucket-server vulnerable to Directory Traversal

private-ip vulnerable to Server-Side Request Forgery

Aim vulnerable to Cross-site Scripting

Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources

Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service

Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write

LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE

NodeJS version of the HAX CMS application is distributed with Default Secrets

HAX CMS NodeJS Application Has Improper Error Handling That Leads to Denial of Service

NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting

Dolibarr has Remote Code Execution Vulnerability (Bypass)

Alchemy Non-SMA and Webauthn Account Security Advisory

@translated/lara-mcp vulnerable to command injection in import_tmx tool

Cadwyn vulnerable to XSS on the docs page

eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files

Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering

mcp-package-docs vulnerable to command injection in several tools

Grafana is vulnerable to XSS attacks through open redirects and path traversal

NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook

Multer vulnerable to Denial of Service via unhandled exception from malformed request

The File Download enables you to allow users to download file and image entities directly using a custom field formatter. It also provides an optional submodule to count and display file downloads in Views, similar to how the core statistics module tracks content views. The File Download module doe

File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing

File Browser’s insecure JWT handling can lead to session replay attacks after logout

Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

GitHub Kanban MCP Server vulnerable to Command Injection

ExecuTorch vulnerable to Heap-based Buffer Overflow attack