olsigjecii · Nov 2, 2026 · Oct 30, 2026 · Oct 30, 2026
@@ -0,0 +1,26 @@
+---
+name: Backup file disclosure
+severity: low
+cvss-score: 5.3
+cvss-vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+cwe-id: CWE-200
+cwe-name: Exposure of Sensitive Information to an Unauthorized Actor
+compliance:
+  HIPAA: "164.306(a)"
+  PCI-DSS v4.0.1: "6.2.4"
+---
+
+A backup or temporary file is accessible through the web server. Such files can expose application source, configuration, credentials, or other information that was not intended to be public. A backup may also be served as plain text instead of passing through the interpreter or access controls used by the original file.
+
+The impact depends on the exposed content. This is a deployment or configuration weakness rather than a vulnerability tied to one software version or CVE.
+
+## How to fix
+
+{% tabs backup-file-disclosure %}
+{% tab backup-file-disclosure generic %}
+Remove backup and temporary files from publicly served directories and store required backups outside the web root with appropriate access controls. Ensure deployment packages contain only the files needed to run the application.
+
+Configure the web server to deny access to backup and editor-generated files, and verify that the affected URLs are no longer accessible. If sensitive data was exposed, investigate access and rotate affected credentials.
+{% endtab %}
+
+{% endtabs %}
@@ -0,0 +1,30 @@
+---
+name: Broken Object Level Authorization
+severity: high
+cvss-score: 8.1
+cvss-vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
+cwe-id: CWE-639
+cwe-name: Authorization Bypass Through User-Controlled Key
+compliance:
+  HIPAA: "164.306(a), 164.312(a)(1), 164.312(d)"
+  ISO 27001: "A.8.2, A.8.3"
+  owasp10: "A1"
+  pci: "6.5.8"
+---
+
+Broken Object Level Authorization (BOLA) occurs when an API accepts an object identifier without checking whether the requester may access or modify that particular object. Changing an identifier can then expose or alter another user's records, even when the requester is allowed to use the endpoint.
+
+The consequences depend on the affected operation and data. This is an authorization weakness rather than a vulnerability tied to one library version or CVE. Scan coverage depends on the selected API scan profile and the features available to the account.
+
+See [OWASP API1:2023](https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/) and [CWE-639](https://cwe.mitre.org/data/definitions/639.html).
+
+## How to fix
+
+{% tabs broken-object-level-authorization %}
+{% tab broken-object-level-authorization generic %}
+Enforce server-side authorization for every operation on every requested object. Scope database lookups to the authenticated principal and tenant, and verify the requested action is permitted before returning or modifying data.
+
+Do not rely on hidden UI controls or unpredictable identifiers as access controls. Deny access by default and test read, update, and delete operations using users with different roles, ownership, and tenant membership.
+{% endtab %}
+
+{% endtabs %}
@@ -0,0 +1,31 @@
+---
+name: highlight.js library with known vulnerabilities
+severity: low
+cvss-score: 4.8
+cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
+cwe-id: CWE-1395
+cwe-name: Dependency on Vulnerable Third-Party Component
+compliance:
+  HIPAA: "164.306(a)"
+  ISO 27001: "A.8.9"
+  owasp10: "A5, A6"
+  pci: "6.2"
+  PCI-DSS v4.0.1: "6.2.4, 6.3.3"
+---
+
+The application uses an outdated version of the highlight.js library, which has known vulnerabilities.
+
+Known issues include prototype pollution (CVE-2020-26237) in versions before 9.18.2 and in versions from 10.0.0 before 10.1.2. Regular expression denial of service also affects multiple language grammars in versions from 9.0.0 before 10.4.1 (GHSA-7wwv-vh3v-89cq).
+
+See the maintainer's [prototype pollution advisory](https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mx) and [denial-of-service advisory](https://github.com/highlightjs/highlight.js/security/advisories/GHSA-7wwv-vh3v-89cq).
+
+## How to fix
+
+{% tabs highlightjs-library-with-known-vulnerabilities %}
+{% tab highlightjs-library-with-known-vulnerabilities generic %}
+Upgrade highlight.js to the latest maintained release containing the applicable security fixes. Version 10.4.1 addresses the historical denial-of-service issue described above; review current advisories for later issues.
+
+Update all distributed builds, language bundles, and copies served by the application.
+{% endtab %}
+
+{% endtabs %}
@@ -0,0 +1,31 @@
+---
+name: markdown-it library with known vulnerabilities
+severity: low
+cvss-score: 4.8
+cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
+cwe-id: CWE-1395
+cwe-name: Dependency on Vulnerable Third-Party Component
+compliance:
+  HIPAA: "164.306(a)"
+  ISO 27001: "A.8.9"
+  owasp10: "A5, A6"
+  pci: "6.2"
+  PCI-DSS v4.0.1: "6.2.4, 6.3.3"
+---
+
+The application uses an outdated version of the markdown-it library, which has known vulnerabilities.
+
+Known issues include regular expression denial of service (CVE-2022-21670) in versions before 12.3.2, and cross-site scripting in older releases (CVE-2015-3295 before 4.1.0 and CVE-2015-10005 before 3.0.0). Processing untrusted Markdown with an affected version can consume excessive resources or produce unsafe HTML.
+
+See the [maintainer's CVE-2022-21670 advisory](https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6vfc-qv3f-vr6c) and [current security advisories](https://github.com/markdown-it/markdown-it/security/advisories).
+
+## How to fix
+
+{% tabs markdown-it-library-with-known-vulnerabilities %}
+{% tab markdown-it-library-with-known-vulnerabilities generic %}
+Upgrade markdown-it to a maintained release that includes all applicable security fixes. Version 12.3.2 fixes CVE-2022-21670, but later advisories also affect newer releases; do not treat that historical minimum as complete remediation.
+
+Update every deployed copy and any dependency that bundles markdown-it. Keep raw HTML disabled for untrusted input, or sanitize rendered HTML before inserting it into a page.
+{% endtab %}
+
+{% endtabs %}
@@ -0,0 +1,31 @@
+---
+name: Marked library with known vulnerabilities
+severity: low
+cvss-score: 4.8
+cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
+cwe-id: CWE-1395
+cwe-name: Dependency on Vulnerable Third-Party Component
+compliance:
+  HIPAA: "164.306(a)"
+  ISO 27001: "A.8.9"
+  owasp10: "A5, A6"
+  pci: "6.2"
+  PCI-DSS v4.0.1: "6.2.4, 6.3.3"
+---
+
+The application uses an outdated version of the Marked library, which has known vulnerabilities.
+
+Known issues include regular expression denial of service (CVE-2022-21680 and CVE-2022-21681) in versions before 4.0.10. Processing specially crafted Markdown with an affected version can consume excessive CPU resources.
+
+See the maintainer's [CVE-2022-21680 advisory](https://github.com/markedjs/marked/security/advisories/GHSA-rrrm-qjm4-v8hf), [CVE-2022-21681 advisory](https://github.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgj), and [current security advisories](https://github.com/markedjs/marked/security/advisories).
+
+## How to fix
+
+{% tabs marked-library-with-known-vulnerabilities %}
+{% tab marked-library-with-known-vulnerabilities generic %}
+Upgrade Marked to the latest maintained release containing all applicable security fixes. Version 4.0.10 fixes the two historical issues above, but it is not a sufficient minimum for all later advisories.
+
+Update every deployed copy. Sanitize generated HTML before rendering untrusted Markdown; upgrading the parser does not replace output sanitization.
+{% endtab %}
+
+{% endtabs %}
@@ -0,0 +1,31 @@
+---
+name: MooTools library with known vulnerabilities
+severity: low
+cvss-score: 4.8
+cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
+cwe-id: CWE-1395
+cwe-name: Dependency on Vulnerable Third-Party Component
+compliance:
+  HIPAA: "164.306(a)"
+  ISO 27001: "A.8.9"
+  owasp10: "A5, A6"
+  pci: "6.2"
+  PCI-DSS v4.0.1: "6.2.4, 6.3.3"
+---
+
+The application uses an outdated version of the MooTools library, which has known vulnerabilities.
+
+Known issues affecting MooTools through 1.5.2 include regular expression denial of service (CVE-2021-32821) and prototype pollution through Object.merge() (CVE-2021-23432).
+
+See the [original denial-of-service disclosure](https://securitylab.github.com/advisories/GHSL-2020-345-redos-mootools/) and [prototype pollution advisory](https://github.com/advisories/GHSA-x6hx-7gh3-3q98). These advisories do not identify a patched release.
+
+## How to fix
+
+{% tabs mootools-library-with-known-vulnerabilities %}
+{% tab mootools-library-with-known-vulnerabilities generic %}
+Replace MooTools with a maintained alternative, remove the affected functionality, or apply a reviewed patch for each applicable vulnerability. Upgrading to 1.5.2 does not fix the listed issues.
+
+Until the dependency is replaced or patched, prevent untrusted input from reaching the affected regular-expression operations and Object.merge(). Review all bundled and separately hosted copies.
+{% endtab %}
+
+{% endtabs %}
@@ -0,0 +1,26 @@
+---
+name: PHP2Shell
+severity: critical
+cvss-score: 9.8
+cvss-vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+cwe-id: CWE-416
+cwe-name: Use After Free
+compliance: {}
+---
+
+PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, memory-safety vulnerabilities in PHP request processing. An unauthenticated attacker may be able to read server memory or execute arbitrary code, depending on the affected version, configuration, and execution environment.
+
+The supported PHP branches received fixes in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Earlier releases in those branches are affected; unsupported branches require a maintained vendor patch or migration to a supported release.
+
+See the PHP maintainers' [out-of-memory handling advisory](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [stale-state advisory](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp). The CVSS 3.1 score above is the scanner's rating; the upstream advisories separately publish CVSS 4.0 scores of 9.2.
+
+## How to fix
+
+{% tabs php2shell %}
+{% tab php2shell generic %}
+Upgrade to the latest supported PHP security release for your branch, including at least the 8.2.35, 8.3.36, 8.4.27, or 8.5.12 fixes as applicable. For distribution-provided PHP, verify the vendor's advisory and patched package version because fixes may be backported.
+
+Restart PHP workers and application services so every running process uses the patched runtime. Check all affected containers and hosts. Configuration mitigations are incomplete and should not replace patching.
+{% endtab %}
+
+{% endtabs %}
@@ -0,0 +1,37 @@
+---
+name: protobuf.js library with known vulnerabilities
+severity: low
+cvss-score: 4.8
+cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
+cwe-id: CWE-1395
+cwe-name: Dependency on Vulnerable Third-Party Component
+compliance:
+  HIPAA: "164.306(a)"
+  ISO 27001: "A.8.9"
+  owasp10: "A5, A6"
+  pci: "6.2"
+  PCI-DSS v4.0.1: "6.2.4, 6.3.3"
+---
+
+The application uses an outdated version of the protobuf.js library, which has known vulnerabilities.
+
+Known issues include:
+
+- Regular expression denial of service (CVE-2018-3738) in versions before 5.0.3, or from 6.0.0 before 6.8.6.
+- Prototype pollution (CVE-2022-25878) in versions from 6.10.0 before 6.10.3, or from 6.11.0 before 6.11.3.
+- Prototype pollution (CVE-2023-36665) in versions from 6.10.0 before 6.11.4, or from 7.0.0 before 7.2.5.
+
+The impact depends on the affected version and how the application processes untrusted input.
+
+See the [maintainer's security advisories](https://github.com/protobufjs/protobuf.js/security/advisories) and [RetireJS advisory references](https://github.com/RetireJS/retire.js/blob/master/repository/jsrepository-master.json).
+
+## How to fix
+
+{% tabs protobufjs-library-with-known-vulnerabilities %}
+{% tab protobufjs-library-with-known-vulnerabilities generic %}
+Upgrade protobuf.js to a maintained release containing all applicable security fixes, and update dependencies that bundle it. The historical 6.11.4 and 7.2.5 fixes do not cover all later advisories.
+
+Update every deployed browser bundle and server dependency. Avoid accepting untrusted schema definitions or configuration unless the application explicitly validates them.
+{% endtab %}
+
+{% endtabs %}
@@ -0,0 +1,31 @@
+---
+name: Quill library with known vulnerabilities
+severity: low
+cvss-score: 4.8
+cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
+cwe-id: CWE-1395
+cwe-name: Dependency on Vulnerable Third-Party Component
+compliance:
+  HIPAA: "164.306(a)"
+  ISO 27001: "A.8.9"
+  owasp10: "A5, A6"
+  pci: "6.2"
+  PCI-DSS v4.0.1: "6.2.4, 6.3.3"
+---
+
+The application uses a version of the Quill library with known vulnerabilities.
+
+Quill 2.0.3 is affected by CVE-2025-15056: HTML export of formula and video embeds can include unescaped values. Rendering this exported HTML without sanitization can allow cross-site scripting. An older report, CVE-2021-3163, concerns versions through 1.3.7 and is disputed.
+
+See the [CVE-2025-15056 researcher advisory](https://fluidattacks.com/advisories/diomedes) and [official release history](https://github.com/slab/quill/releases).
+
+## How to fix
+
+{% tabs quill-library-with-known-vulnerabilities %}
+{% tab quill-library-with-known-vulnerabilities generic %}
+Sanitize and correctly escape exported HTML before rendering it, including HTML produced from formula and video embeds. Restrict untrusted embed content and validate the fields used to construct it.
+
+Check the official security guidance and release notes for a fix applicable to your version. Quill 2.0.3 is itself affected by CVE-2025-15056; upgrading to that release alone does not remediate the issue.
+{% endtab %}
+
+{% endtabs %}
@@ -0,0 +1,31 @@
+---
+name: React2Shell
+severity: critical
+cvss-score: 10.0
+cvss-vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+cwe-id: CWE-502
+cwe-name: Deserialization of Untrusted Data
+compliance:
+  HIPAA: "164.306(a)"
+  ISO 27001: "A.5.33, A.5.34, A.8.12, A.8.3"
+  owasp10: "A3"
+  pci: "6.5.1"
+  PCI-DSS v4.0.1: "6.2.4"
+---
+
+React2Shell (CVE-2025-55182) is an unauthenticated remote code execution vulnerability in React Server Components. Unsafe deserialization of requests to server function endpoints can allow an attacker to execute code on the server. Applications that do not use a framework or bundler supporting React Server Components are not affected by this vulnerability.
+
+Affected packages include react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0. Next.js tracks its downstream impact as CVE-2025-66478.
+
+See the [React maintainer advisory](https://github.com/react/react/security/advisories/GHSA-fv66-9v8q-g76r) and [framework-specific guidance](https://vercel.com/kb/bulletin/react2shell).
+
+## How to fix
+
+{% tabs react2shell %}
+{% tab react2shell generic %}
+Upgrade the affected React Server Components packages and the framework that supplies them to maintained releases containing all applicable security fixes. React's original RCE fixes were 19.0.1, 19.1.2, and 19.2.1, but later security advisories require additional updates.
+
+Follow the [current React security guidance](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components), rebuild, and redeploy every affected application. Verify the versions actually deployed, including transitive dependencies. If the service was exposed while vulnerable, investigate possible compromise and rotate any secrets that may have been exposed.
+{% endtab %}
+
+{% endtabs %}
@@ -0,0 +1,31 @@
+---
+name: Swiper library with known vulnerabilities
+severity: low
+cvss-score: 4.8
+cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
+cwe-id: CWE-1395
+cwe-name: Dependency on Vulnerable Third-Party Component
+compliance:
+  HIPAA: "164.306(a)"
+  ISO 27001: "A.8.9"
+  owasp10: "A5, A6"
+  pci: "6.2"
+  PCI-DSS v4.0.1: "6.2.4, 6.3.3"
+---
+
+The application uses an outdated version of the Swiper library, which has known vulnerabilities.
+
+Known issues include prototype pollution (CVE-2021-23370) in versions before 6.5.1. A later prototype pollution issue, CVE-2026-27212, affects versions from 6.5.1 before 12.1.2. Unsafe handling of attacker-controlled configuration can modify inherited object properties and affect application behavior.
+
+See the [maintainer's CVE-2026-27212 advisory](https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643).
+
+## How to fix
+
+{% tabs swiper-library-with-known-vulnerabilities %}
+{% tab swiper-library-with-known-vulnerabilities generic %}
+Upgrade Swiper to a maintained release containing the 12.1.2 fix and all subsequent applicable security fixes. Upgrading only to 6.5.1 does not address the later advisory.
+
+Update every bundled or separately hosted copy, and avoid passing untrusted configuration objects to the library.
+{% endtab %}
+
+{% endtabs %}
@@ -0,0 +1,31 @@
+---
+name: Video.js library with known vulnerabilities
+severity: low
+cvss-score: 4.8
+cvss-vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
+cwe-id: CWE-1395
+cwe-name: Dependency on Vulnerable Third-Party Component
+compliance:
+  HIPAA: "164.306(a)"
+  ISO 27001: "A.8.9"
+  owasp10: "A5, A6"
+  pci: "6.2"
+  PCI-DSS v4.0.1: "6.2.4, 6.3.3"
+---
+
+The application uses an outdated version of the Video.js library, which has known vulnerabilities.
+
+CVE-2021-23414 affects Video.js versions before 7.14.3. The library's URL handling can allow cross-site scripting when attacker-controlled input reaches the affected code.
+
+See the [maintainer's security fix](https://github.com/videojs/video.js/commit/b3acf663641fca0f7a966525a72845af7ec5fab2) and [official releases](https://github.com/videojs/video.js/releases).
+
+## How to fix
+
+{% tabs videojs-library-with-known-vulnerabilities %}
+{% tab videojs-library-with-known-vulnerabilities generic %}
+Upgrade Video.js to the latest maintained release containing the 7.14.3 fix and all subsequent applicable security fixes.
+
+Update all player bundles and hosted copies. Validate untrusted URLs and review plugins that supply URLs to the player.
+{% endtab %}
+
+{% endtabs %}