Search Vulnerabilities

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)

Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist

OpenClaw < 2026.6.6 Authentication Bypass via Git ext transport

OpenClaw < 2026.6.6 Authentication Bypass via Environment Filtering

RestrictedPython guard hooks can be shadowed via positional-only arguments

Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files

Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)

n8n - AST Validator Bypass in Python Code Node

Picklescan - Arbitrary Code Execution via Unsafe Numpy Function Detection Bypass

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

File Browser: Command Allowlist Bypass via Shell Metacharacter Injection

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

Mastodon: SSRF protection bypass on older Ruby versions

Ghost: Private IP filtering bypass to make server-side requests to internal services

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)