Advisory Catalog

Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence

Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

CKEditor: Cross-site scripting (XSS) in the engine package

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Astro: Arbitrary CSS injection in Astro View Transitions

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

Electron: Frame subscription trusts GPU-supplied frame geometry

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

pypdf: Unvalidated JPEG image data loading

SvelteKit : XSS via untrusted cache-control header in prerendered page

SvelteKit: URL redirection to untrusted site via enhanced form submission

djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

virtualenv: Pip seeding with download omits wheel digest verification

virtualenv: Venv configuration readback can reinterpret path boundaries

virtualenv: Downloaded wheel selection and caching precede verification

ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

ApostropheCMS: Path traversal in uploadfs

ApostropheCMS: Missing Authentication in `cleanExport` Route

Vite: Cross origin script execution through Vite custom middleware

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

fast-uri vulnerable to improper path equivalence in relative reference normalization

markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

ClickMigrate has Path Traversal in "revision -m" argument

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

Contao: Cross-site request forgery in custom backend actions

Strawberry legacy graphql-ws retains naturally completed subscription slots

msgpack5: Decoding negative int64 values mutates the input buffer

Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service