Advisory catalog

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with fi…

nvd ·

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so …

nvd ·

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefi…

nvd ·

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented fro…

nvd ·

@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query st…

nvd ·

@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, …

nvd ·

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, i…

nvd ·

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a serv…

nvd ·

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-p…

nvd ·

Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process  vm2  sandb…

nvd ·

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/co…

nvd ·

### Summary

nvd ·

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions

cve-program ·

https://cpan.org/modules: HTTP-Headers-ActionPack

Malicious code in orqiva-runtime-win32-x64 (npm)

osv · GHSA-8j59-g9mq-7hf9

npm: orqiva-runtime-win32-x64

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

osv · CVE-2026-109461

npm: @azure/msal-node

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

osv · CVE-2026-109869

npm: undici · npm: undici · npm: undici

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

osv · CVE-2026-109924

npm: undici · npm: undici · npm: undici

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

osv · CVE-2026-109841

npm: undici · npm: undici

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

osv · CVE-2026-115889 · RUSTSEC-2026-0380

crates.io: wasmtime · crates.io: wasmtime

Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type

osv · CVE-2026-115892 · RUSTSEC-2026-0378

crates.io: wasmtime · crates.io: wasmtime

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influ…

nvd ·

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it …

nvd ·

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditio…

nvd ·

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns t…

nvd ·

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wa…

nvd ·

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tabl…

nvd ·

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

osv ·

npm: fallow · npm: @fallow-cli/fallow-node · crates.io: fallow-cli

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

osv · CVE-2026-115569

npm: fallow · npm: @fallow-cli/fallow-node · crates.io: fallow-cli

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

osv · CVE-2026-113872

npm: multer

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

osv · CVE-2026-115895

npm: happy-dom

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can m…

cve-program ·

Vendor product: Totolink

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an au…

cve-program ·

Vendor product: Totolink

A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make …

cve-program ·

Vendor product: Totolink

A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker ca…

cve-program ·

Vendor product: Totolink

A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can…

cve-program ·

Vendor product: Totolink

A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authe…

cve-program ·

Vendor product: Totolink

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make a…

cve-program ·

Vendor product: Totolink

A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker c…

cve-program ·

Vendor product: Totolink

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can…

cve-program ·

Vendor product: Totolink

A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker…

cve-program ·

Vendor product: Totolink

A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can mak…

cve-program ·

Vendor product: Totolink

Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14

nvd ·

An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a specially crafted text input.

nvd ·

Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format

nvd ·

** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control.

nvd ·

Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 c…

nvd ·

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a…

nvd ·