Advisory Catalog

OpenFGA Authorization Bypass

Auth0 NextJS SDK v4 Missing Session Invalidation

AngularJS improperly sanitizes SVG elements

@account-kit/smart-contracts Allowlist Module Bypass Vulnerability

YesWiki Stored XSS Vulnerability in Comments

Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting

Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

n8n Vulnerable to Stored XSS through Attachments View Endpoint

net-imap rubygem vulnerable to possible DoS by memory exhaustion

Moodle allows IDOR when accessing the cohorts report

Moodle has an IDOR in messaging web service which allows access to some user details

Moodle's AJAX section delete does not respect course_can_delete_section()

Moodle has reflected Cross-site Scripting risk in policy tool

Moodle has an IDOR in web service which allows users enrolled in a course to access some details of other users

Moodle allows IDOR in RSS block, which allows access to additional RSS feeds

Moodle reveals student identities through assignment submissions search on anonymous submissions

Moodle makes some user data available before completing second factor with MFA enabled

Moodle shows hidden grades to users without permission on some grade reports

GraphQL Armor Cost-Limit Plugin Bypass via Introspection Query Obfuscation

Fleet doesn’t validate a server’s certificate when connecting through SSH

Moodle self enrollment available before completing second factor with MFA enabled

CNCF K3s Kubernetes kubelet configuration exposes credentials

Mattermost Playbooks fails to validate the uniqueness and quantity of task actions

Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type

This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability is mitigated by the fact that a site admin would have to perform further steps after

Block Class enables you to add custom attributes to blocks. The module did not sufficiently sanitize custom attribute input, allowing for potential XSS attacks when malicious JavaScript was injected as a custom attribute. This vulnerability is mitigated by the fact that an attacker must have a rol

This module enables you to put a site wide bootstrap themed alert message on the top of every page. The module doesn't sufficiently filter text input when leading to a possible XSS attacks. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administe

Colorbox is a module that allows Images, and iframed or inline content to be displayed in a modal above the current page. The Colorbox module doesn't sufficiently sanitize data attributes before opening modals. This vulnerability is mitigated by the fact that an attacker must have a role with perm

uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries

pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

Laravel Starter Cross Site Scripting (XSS)

OctoPrint Authenticated Reverse Proxy Page Authentication Bypass

Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters

GoBGP crashes in the flowspec parser

GoBGP does not verify that the input length

GoBGP does not properly check the input length

QMarkdown Cross-Site Scripting (XSS) vulnerability

one-api Cross-site Scripting vulnerability

Rasa Pro Missing Authentication For Voice Connector APIs

PEAR HTTP_Request2 vulnerable to Cross-site Scripting

PyTorch Improper Resource Shutdown or Release vulnerability

Mattermost Incorrect Authorization vulnerability

golang.org/x/net vulnerable to Cross-site Scripting

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal