Path Traversal

astrbot is vulnerable to a Path Traversal. The vulnerability is due to improper validation or sanitization of file path inputs, allowing attackers to access files outside the intended directories...

Improper File Validation

umbraco.cms is vulnerable to improper file validation. The vulnerability is due to insufficient checks on uploaded file extensions, allowing bypass of configured restrictions via manipulated API requests...

Privilege Escalation

org.wso2.am, am-parent, org.wso2.is, identity-server-parent are vulnerable to privilege escalation. The vulnerability is due to improper validation and access control in the SOAP admin services, which allows attackers to assign elevated privileges to self-registered users under specific deploymen...

Improper Input Validation

github.com/fabiolb/fabio is vulnerable to Improper Input Validation. The vulnerability is due to insecure header handling due to a flaw in processing hop-by-hop headers, allowing clients to remove or manipulate trusted X-Forwarded headers via the Connection header...

Cross-site Scripting (XSS)

github.com/forceu/gokapi is vulnerable to stored cross-site scripting XSS. The vulnerability is due to insufficient sanitization and validation of filenames with embedded JavaScript, allows an attacker to execute malicious JavaScript code in the context of other users’ browsers...

Null Pointer Dereference

github.com/quic-go/quic-go is vulnerable to a Nil-Pointer Dereference. The vulnerability is due to improper handling of ACKs for path probe packets, where they are crafted and sent by a malicious client in a way that triggers the nil-pointer dereference in the server's loss recovery logic, It...

Directory Traversal

tar-fs is vulnerable to Directory traversal. The vulnerability is due to improper path validation during tarball extraction, allowing attackers to write files outside the target directory and potentially overwrite system files or inject malicious content...

Sensitive Data Exposure

django-helpdesk is vulnerable to Sensitive Data Exposure. The vulnerability is due to insecure file permission settings due to os.umask0 in models.py, allows an attacker to access sensitive files or data that should be protected...

Improper Authentication

Mattermost is vulnerable to Improper Authentication. The vulnerability is due to insecure OAuth credential handling due to failure to clear Google OAuth credentials when converting user accounts to bot accounts, enabling unauthorized access via the Google OAuth signup flow...

Server-Side Request Forgery (SSRF)

mcp-markdownify-server is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper input validation due to the Markdownify.get function allowing attacker-controlled URLs to be fetched and their responses read via conversion tools like webpage-to-markdown,...

Improper Token Invalidation

github.com/mattermost/mattermost-server is vulnerable to improper token invalidation. The vulnerability is due to failure to invalidate personal access tokens upon user deactivation, allowing continued access through previously issued tokens...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to insufficient enforcement of access restrictions, which allows guest users to access metadata about members of public channels via the channel members API endpoint...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to insufficient enforcement of access restrictions for System Manager roles, allowing users to access unauthorized team details via direct API requests even when configured with 'No access' ...

Information Disclosure

com.erudika, para-server is vulnerable to Information disclosure. The vulnerability is due to unredacted logging of access and secret keys during variable assignment, which is unnecessary for debugging or system health, allows an attacker with access to the logs to obtain sensitive credentials...

Improper Handling Of Case Sensitivity

org.apache.tomcat, tomcat-catalina is vulnerable to improper handling of case sensitivity. The vulnerability is due to inconsistent case sensitivity handling in the pathInfo component of URIs mapped to the CGI servlet, which allows security constraints to be bypassed...

SQL Injection

Apache Superset is vulnerable to SQL injection. The vulnerability is due to improper input handling in the sqlExpression fields, allowing attackers to inject sub-queries and bypass row-level security...

Spoofing Attack

org.springframework.cloud, spring-cloud-gateway-server is vulnerable to Spoofing Attack. The vulnerability is due to insufficient validation of X-Forwarded-For and Forwarded headers from untrusted proxies, allowing attackers to spoof client IP addresses...

Arbitrary Command Execution

github.com/cli/go-gh is vulnerable to Arbitrary command execution. The vulnerability is due to unsafe handling of GitHub-provided URLs, allowing an attacker-controlled GitHub Enterprise Server to replace HTTP URLs with local file paths that could be executed on the user's machine...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to insufficient permission checks when changing team privacy settings, allowing unauthorized team administrators to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy...

Permission Verification Flaw

github.com/navidrome/navidrome is vulnerable to a permission verification flaw. The vulnerability is due to insufficient permission verification, allowing regular authenticated users to perform administrator-only transcoding configuration operations...

Arbitrary File Copy

gradio is vulnerable to an Arbitrary File Copy. The vulnerability is due to insufficient validation and access control in the flagging feature, which allows unauthenticated users to specify arbitrary file paths for copying without proper restrictions...

SQL Injection

github.com/navidrome/navidrome is vulnerable to SQL injection. The vulnerability is due to improper input validation of the role parameter in the /api/artist API endpoint, allowing attackers to inject arbitrary SQL queries...

XML External Entity (XXE) Injection

PHPOffice/math is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper XML parsing using the LIBXMLDTDLOAD flag without filtering, allowing external entity resolution when loading XML data...

Unauthorized File Disclosure

mcp-markdownify-server is vulnerable to Unauthorized File Disclosure. The vulnerability is due to improper access control due to the get-markdown-file tool allowing external prompts to read arbitrary files from the host system...

Denial Of Service (DoS)

vLLM is vulnerable to Denial of Service DoS. The vulnerability is due to improper input validation that accepts unexpected or malformed pattern and type fields in tool-related requests, which can crash the inference worker...

Denial Of Service (DoS)

vllm is vulnerable to Denial of Service ReDoS. The vulnerability is due to improper handling of invalid regular expressions in structured output, which allows an attacker to crash the server by submitting a crafted regex...

Denial Of Service (DoS)

vllm is vulnerable to a Denial of service DoS. The vulnerability is due to improper handling of invalid jsonschema in the /v1/completions API’s Guided Param, which allows an attacker to cause a denial of service by crashing the server...

Hash Collision Attack

vllm is vulnerable to hash collision and data integrity issues. The vulnerability is due to improper image serialization using only raw pixel bytes without metadata, allowing attackers to create images with identical hashes and exploit cache poisoning or access sensitive data...

Timing Side-channel Attacks

vllm is vulnerable to Timing side-channel attacks. The vulnerability is due to timing discrepancies during the prefill phase by the PageAttention mechanism reusing matching prefix chunks, which speeds up token generation and allows an attacker to infer prompt similarity or presence...

Improper Certificate Validation

redshift-connector is vulnerable to Improper Certificate Validation. The vulnerability is due to improper SSL certificate validation due to the BrowserAzureOAuth2CredentialsProvider plugin skipping SSL verification for the Identity Provider, allowing token interception...

Sensitive Information Disclosure

github.com/edgelesssys/contrast is vulnerable to information disclosure. The vulnerability is due to improper logging configuration due to secrets being written to stderr and Kubernetes logs when the log level is set to info or debug, which is the default...

Improper Access Control

Apache Commons BeanUtils is vulnerable to Improper Access Control. The vulnerability is due to insecure property access due to failure to restrict access to the declaredClass property of Java enums, allowing attackers to access the classloader and potentially execute arbitrary code...

Open Redirection

mautic/core is vulnerable to Open Redirection. The vulnerability is due to insufficient validation of the returnUrl parameter, which allows an attacker to redirect users to arbitrary external websites, potentially enabling phishing attacks...

Regular Expression Denial Of Service (ReDoS)

vLLM is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to the use of a highly complex and nested regular expression for tool call detection, which allows an attacker to trigger excessive backtracking and degrade service performance...

Insecure Direct Object Reference (IDOR)

mautic/core is vulnerable to an Insecure Direct Object Reference IDOR. The vulnerability is due to missing authorization checks in the segment cloning function, which allows authenticated users to clone segments even if they don’t have the necessary permissions...

Regular Expression Denial Of Service (ReDoS)

vllm is vulnerable to Regular Expression Denial of Service ReDoS attacks. The vulnerability is due to certain regular expression patterns that lead to catastrophic backtracking when processing crafted input, allowing an attacker to slow down or crash the application...

Cross-Site Scripting (XSS)

github.com/argoproj/argo-cd is vulnerable to cross-site scripting XSS. The vulnerability is due to improper URL protocol filtering on the repository page, allowing attackers to perform actions such as creating, modifying, and deleting Kubernetes resources via the API...

Username Enumeration

mautic/core is vulnerable to User Enumeration. The vulnerability is due to differences in response times between valid and invalid usernames in the "Forget your password" functionality, which allows an attacker to determine the existence of valid usernames...

Unauthorized Access To Unpublished Page Previews

mautic/core is vulnerable to Unauthorized Access to unpublished page previews. The vulnerability is due to missing authorization checks on predictable preview URLs, allowing unauthenticated users and search engines to access and index draft content...

Sensitive Information Disclosure

mautic/core is vulnerable to Sensitive Information Disclosure. The vulnerability is due to unauthenticated arbitrary file access where the missing web server restrictions on .env files, allowing attackers to directly view sensitive configurations via a browser...

Unauthorized Access

com.ritense.valtimo:object-management and com.ritense.valtimo:objecten-api is vulnerable to Unauthorized Access. The vulnerability is due to improper access control and the lack of enforcement of object-management configurations, allowing unauthorized users to list, view, edit, create, or delete...

Directory Traversal

Traefik is vulnerable to Directory Traversal. The vulnerability is due to insufficient path sanitization due to the ability to manipulate URLs containing /../ which can bypass middleware and access unintended backend services when using PathPrefix, Path, or PathRegex matchers...

Directory Traversal

Traefik is vulnerable to Directory Traversal. The vulnerability is due to insufficient path sanitization due to the ability to manipulate URLs containing /../ which can bypass middleware and access unintended backend services when using PathPrefix, Path, or PathRegex matchers...

Cross-site Scripting (XSS)

chrome-php/chrome is vulnerable to cross-site scripting XSS. The vulnerability is due to improper encoding due to CSS Selector expressions not being properly escaped, allowing injection of malicious scripts...

OS Command Injection

LLama-Index CLI is vulnerable to OS Command Injection. The vulnerability is due to improper input handling due to unsanitized use of the --files argument passed directly into os.system, allowing arbitrary command execution...

Information Leakage

djangoselect2 is vulnerable to information leakage. The vulnerability is due to improper handling of instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget, allowing an attacker to access restricted query sets and sensitive data...

Server Side Request Forgery (SSRF)

@strapi/admin is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of webhook URLs, allowing requests to internal domains such as localhost and 127.0.0.1...

Deserialization Of Untrusted Data

org.apache.inlong, manager-pojo is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to insecure deserialization in InLong JDBC, which allows attackers to bypass security mechanisms and perform arbitrary file read attacks...

Deserialization Of Untrusted Data

Apache InLong is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to improper input validation during deserialization, which allows an attacker to exploit URL encoding and backspace characters to bypass security checks and perform a JDBC injection attack...

Path Traversal

@supabase/auth-js is vulnerable to Path Traversal . The vulnerability is due to missing UUID validation on user-supplied inputs, which allows an attacker to manipulate URL paths and invoke unintended API functions...