Advisory Catalog

Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function

Markdownify MCP Server allows attackers to read arbitrary files

multicast in source builds from vulnerable setuptools dependency

vLLM Tool Schema allows DoS via Malformed pattern and type Fields

vLLM allows clients to crash the openai server with invalid regex

vLLM DOS: Remotely kill vllm over http with invalid JSON schema

vLLM vulnerable to Regular Expression Denial of Service

vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`

The "Simple Klaro" module adds the "Klaro! A Simple Consent Manager" to your website and allows you to configure it according to your needs in the Drupal backend. The module doesn't sufficiently sanitise data attributes allowing persistent Cross Site Scripting (XSS) attacks. This vulnerability is

This module addresses the General Data Protection Regulation (GDPR) and the EU Directive on Privacy and Electronic Communications. The module doesn't sufficiently verify whether "disabled JavaScript" entries are valid or correspond to actual scripts on the page. As a result, an attacker could injec

This module enables you to setup a repeating date rule that users can "book" different dates, allowing you to let users register for a variety of different things like conference rooms or guitar lessons. This module has a permission of "view booking" and "view booking contact" which allows you to v

Mautic has an Open Redirect vulnerability on user unlock path.

Mautic segment cloning doesn't have a proper permission check

Mautic allows user name enumeration due to response time difference on password reset form

Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure

TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability

TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability

Mautic does not shield .env files from web traffic

Chrome PHP is missing encoding in `CssSelector`

Laravel Rest Api has a Search Validation Bypass

radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

ActiveMQ Artemis AMQ Broker Operator Starting Credentials Reuse

pypickle Incorrect Privilege Assignment vulnerability

HumanSignal label-studio-ml-backend Deserialization of Untrusted Data vulnerability

pypickle unsafe deserialization vulnerability

A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The attac

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking

docarray prototype pollution

FunAudioLLM InspireMusic deserialization vulnerability

OpenFGA Authorization Bypass

Marked allows Regular Expression Denial of Service (ReDoS) attacks

zot logs secrets

Insufficient input sanitization in ejson2env

containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.

Drupal Quick Node Block Missing Authorization vulnerability

Drupal Quick Node Block Missing Authorization vulnerability

Character injection in Hubble CLI

The Backup Plus extension for TYPO3 (ns_backup) allows XSS

The Backup Plus extension for TYPO3 (ns_backup) allows command injections

[clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability

The femanager TYPO3 extension allows Insecure Direct Object Reference

TYPO3 Allows Unrestricted File Upload in File Abstraction Layer

TYPO3 Allows Information Disclosure via DBAL Restriction Handling

TYPO3 CMS Webhooks Server Side Request Forgery

Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype poll

SeaweedFS Vulnerable to SQL Injection