Improper Neutralization of Null Byte or NUL Character

Overview Affected versions of this package are vulnerable to Improper Neutralization of Null Byte or NUL Character in EventLogAppender, which passes rendered content through to ReportEventW unescaped, and that API takes a null terminated string, so a NUL ends the stored record at that point. An...

Allocation of Resources Without Limits or Throttling

Overview org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the retrieval process of multiple template resources with user-supplied metadata. An attacker can exhaust...

Authorization Bypass Through User-Controlled Key

Overview org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the handling of cross-cluster search requests under the Remote Cluster Security RCS 2.0 model. An attacker can...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the CCITT fax decompression paths T4TiffCompression.Decompress and ModifiedHuffmanTiffCompression.Decompress, which hand a decoded run length to the unchecked bit writers in BitWriterUtils.cs without first...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in JSONReader.string and JSONReader.skipWhiteSpace in com.rabbitmq.tools.json, neither of which treats CharacterIterator.DONE as a terminator, so the string scanner appends that sentinel without bound and the line comment...

Credential Exposure

Overview Affected versions of this package are vulnerable to Credential Exposure in ConnectionFactoryConfigurator.loadConnectionFactory, Map, String, which concatenates the raw AMQP URI, username and password included, into three IllegalArgumentException messages. A user with read access to the...

Encoding Error

Overview Affected versions of this package are vulnerable to Encoding Error in ValueWriter.writeShortstr in com.rabbitmq.client.impl, reached because ValueReader.readShortstr substitutes U+FFFD for malformed UTF-8 bytes on decode, so each bad byte re-encodes to three and a 255 byte shortstr...

Cross-site Scripting (XSS)

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the quotedString function in lib/handlebars/compiler/code-gen.js, which writes static template text into the JavaScript that Handlebars.precompi...

Cross-site Scripting (XSS)

Overview org.webjars.npm:handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the quotedString function in lib/handlebars/compiler/code-gen.js, which writes static template text into the JavaScript that...

Authorization Bypass Through User-Controlled Key

Overview @payloadcms/storage-s3 is a Payload storage adapter for Amazon S3 Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the S3 client-side direct upload flow in S3ClientUploadHandler.ts, where signed PUT URLs are generated without an...

Missing Authorization

Overview @payloadcms/plugin-mcp is a MCP Model Context Protocol capabilities with Payload Affected versions of this package are vulnerable to Missing Authorization via the MCP API Keys collection in createApiKeysCollection.ts, which prior to the fix applied no access controls to the generated...

Improper Resource Shutdown or Release

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Resource Shutdown or Release in the gettokenbincountsandmask function of the Penalty Handler component. An attacker can cause a denial of...

Access Control Bypass

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Access Control Bypass via the updateDocument function in packages/payload/src/collections/operations/utilities/update.ts, where the password field is extracted...

Regular Expression Denial of Service (ReDoS)

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via unbounded multipart request processing in processMultipart.ts. An unauthenticated attacker can send an arbitraril...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via document read operations that return the apiKey field without omitting it, allowing an authenticated user with read access to other user documents to retrieve those users' active API keys in plaintext. The fix...

Missing Authorization

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Missing Authorization via document read operations that return the apiKey field without omitting it, allowing an authenticated user with read access to other us...

Improper Enforcement of a Single, Unique Action

Overview @payloadcms/plugin-ecommerce is an Ecommerce plugin for Payload Affected versions of this package are vulnerable to Improper Enforcement of a Single, Unique Action via the confirmOrder endpoint in the Stripe payment adapter, where a settlement webhook or confirmation request can be...

Missing Authorization

Overview @payloadcms/drizzle is an A library of shared functions used by different payload database adapters Affected versions of this package are vulnerable to Missing Authorization via the contains query operator on relationship, upload, and join fields, where access control filters injected fo...

Missing Authorization

Overview @payloadcms/db-mongodb is a The officially supported MongoDB database adapter for Payload Affected versions of this package are vulnerable to Missing Authorization via the contains query operator on relationship, upload, and join fields, where access control filters injected for a relate...

Missing Authorization

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Missing Authorization via the contains query operator on relationship, upload, and join fields, where access control filters injected for a related collection a...

Improper Authorization

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Improper Authorization via the refreshOperation function in packages/payload/src/auth/operations/refresh.ts, where the collection associated with the...

Incorrect Authorization

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Incorrect Authorization via the collection duplication endpoint /:id/duplicate, where the disableDuplicate collection setting was not enforced at the operation...

Missing Authorization

Overview @payloadcms/plugin-stripe is a Stripe plugin for Payload Affected versions of this package are vulnerable to Missing Authorization via the Stripe REST proxy endpoint packages/plugin-stripe/src/routes/rest.ts, which previously defaulted to enabled and applied only a logged-in user check...

Prototype Pollution

Overview @payloadcms/plugin-import-export is an Import-Export plugin for Payload Affected versions of this package are vulnerable to Prototype Pollution via multipart Content-Type header parsing in the Import Export plugin, where malformed Content-Type values with ambiguous parameter separators a...

SQL Injection

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to SQL Injection through the read query path in find, findDistinct, findVersions, update, and join query handling in the Payload collection and global operations. ...

Open Redirect

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Open Redirect through the getSafeRedirect utility in packages/payload/src/utilities/getSafeRedirect.ts and the authentication forms in...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect through the getSafeRedirect utility in packages/payload/src/utilities/getSafeRedirect.ts and the authentication forms in examples/auth/src/app/app/login/LoginForm/index.tsx and...

Authorization Bypass Through User-Controlled Key

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via polymorphic join query validation in validateSearchParams.ts, where hidden or read-restricted fields are no...

Use of Password Hash With Insufficient Computational Effort

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort via generatePasswordSaltHash.ts and the local authentication strategy, which use insufficiently stro...

Incorrect Authorization

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Incorrect Authorization via the sort handling in collection, global, version, join, and update query paths. An attacker can reveal limited information about...

Insufficiently Protected Credentials

Overview @modelcontextprotocol/core is a Model Context Protocol for TypeScript — public Zod schemas spec + OAuth/OpenID Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the fetchToken and discardIfIssuerMismatch functions in the OAuth client...

Insufficiently Protected Credentials

Overview @modelcontextprotocol/client is a Model Context Protocol implementation for TypeScript - Client package Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the fetchToken and discardIfIssuerMismatch functions in the OAuth client authentication flo...

Insufficiently Protected Credentials

Overview @modelcontextprotocol/sdk is a Model Context Protocol implementation for TypeScript Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the fetchToken and discardIfIssuerMismatch functions in the OAuth client authentication flow, where the SEP-235...

Insufficiently Protected Credentials

Overview @modelcontextprotocol/server-legacy is a Frozen v1 SSE transport and OAuth Authorization Server helpers for the Model Context Protocol TypeScript SDK. Deprecated; use StreamableHTTP and a dedicated OAuth server in production. Affected versions of this package are vulnerable to...

Server-side Request Forgery (SSRF)

Overview i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via insufficient validation in isSafeUrlSegment functions in lib/utils.js,...

Server-side Request Forgery (SSRF)

Overview org.webjars.npm:i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via insufficient validation in isSafeUrlSegment functions in...

Incorrect Behavior Order

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order via the webhook generator initialization process. An attacker can access and exfiltrate sensitive secrets by bypassing label enforcement checks and referencing secrets not intended for webhook use. This is only...

Directory Traversal

Overview org.rundeck:rundeck-core is an enable Self-Service operations. Affected versions of this package are vulnerable to Directory Traversal via the editProjectNodeSourceFile or apiSourceGetContent endpoints when the resources.source.N.config.file parameter is set to an absolute path. An...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the editProjectNodeSourceFile or apiSourceGetContent endpoints when the resources.source.N.config.file parameter is set to an absolute path. An attacker can access sensitive files, such as database passwords and...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the extends process in template inheritance when the top-level nocachehash is not restored, allowing a forged SmartyNocache marker to be injected into the regenerated PHP cache file. An attacker can execute...

Out-of-bounds Read

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Out-of-bounds Read in the convssmforward function of the Completions Request Handler component. An attacker can cause a denial of service by...

Prototype Pollution

Overview @graphql-tools/utils is a Common package containing utils and types for GraphQL tools Affected versions of this package are vulnerable to Prototype Pollution via the mergeDeep function, which fails to block reserved property keys such as proto, constructor, and prototype before recursive...

Denial of Service (DoS)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Denial of Service DoS via the HTTP metrics middleware in rust/src/server/src/middleware/metrics.rs, where arbitrary HTTP method tokens sent by an...

Reachable Assertion

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Reachable Assertion via a P0/P1 multimodal processor cache drift condition in vllm/multimodal/cache.py and the V1 engine core. When the frontend P0...

Use of Cache Containing Sensitive Information

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the /v1/responses endpoint, where tokensinput stores the salt on the engine input only when it is...

Missing Authentication for Critical Function

Overview filament/filament is an A collection of full-stack components for accelerated Laravel app development. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the app-based multi-factor authentication management process. An attacker can change...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient sanitization in the HTML purification logic, allowing an attacker to inject and execute arbitrary JavaScript in a victim's browser...

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient sanitization in the HTML purification logic, allowing an attacker to inject and execute arbitrary JavaScript in a...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the computeframesindextosample method in vllm/multimodal/video.py, where the fps and...

Denial of Service (DoS)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Denial of Service DoS via the computeframesindextosample method in vllm/multimodal/video.py, where the GLMGAVideoBackend class applies no upper boun...