CVE-2025-55008 AuthKit React Router: Sensitive auth data rendered in HTML

The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by...

GHSA-VQVC-9Q8X-VMQ6 The AuthKit React Router Library rendered sensitive auth data in HTML

In versions before 0.7.0, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. Impact This information disclosure could lead to...

CVE-2025-51458

SQL Injection in editorsqlrun and queryex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via crafted input passed to the /v1/editor/sql/run or /v1/editor/chart/run endpoints, interacting with apieditorv1.editorsqlrun, editorchartrun, and...

DB-GPT 命令注入漏洞

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A security vulnerability exists in DB-GPT version 0.7.0, which stems from a file upload vulnerability in agent.hub.controller.refreshplugins that could lead to the execution of arbitrary...

@actions-for-rust/core (>=0.1.6, <=0.1.8), @actions-rs-plus/core (>=0.0.0, <=0.10.0) +128 more potentially affected by CVE-2025-5890 via @actions/glob (>=0.1.2, <=0.7.0)

@actions/glob NPM version =0.1.2, =0.1.6, =0.0.0, =0.1.0, =0.1.0, =1.0.1-2a6268e89ea5fbc66dadd1d897cac75b3f0a63e4.0, =0.1.0, =1.0.0, =4.0.0, =3.2.5, =1.1.0-rc.0, =3.2.2, =3.2.6 - @cirunlabs/cache 4.0.3 and more Source cves: CVE-2025-5890 Source advisory: SNYK:JS-ACTIONSGLOB-11484208...

vLLM 安全漏洞

vLLM is a high throughput and memory efficient inference and service engine for LLM from the vLLM open source. A security vulnerability exists in vLLM versions prior to 0.7.0 through 0.9.0, which stems from the use of only raw pixel data without including metadata in the image hash method, which...

CVE-2024-40640

vodozemac is an open source implementation of Olm and Megolm in pure Rust. Versions before 0.7.0 of vodozemac use a non-constant time base64 implementation for importing key material for Megolm group sessions and PkDecryption Ed25519 secret keys. This flaw might allow an attacker to infer some...

CVE-2023-0919

Missing Authentication for Critical Function in GitHub repository kareadita/kavita prior to 0.7.0...

CVE-2023-45655

Cross-Site Request Forgery CSRF vulnerability in PixelGrade PixFields plugin = 0.7.0 versions...

CVE-2021-28036

An issue was discovered in the quinn crate before 0.7.0 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures...

External Control of File Name or Path

Overview dbgpt is a DB-GPT is an experimental open-source project that uses localized GPT large models to interact with your data and environment. With this solution, you can beassured that there is no risk of data leakage, and your data is 100% private and secure. Affected versions of this packa...

SQL Injection

Overview dbgpt is a DB-GPT is an experimental open-source project that uses localized GPT large models to interact with your data and environment. With this solution, you can beassured that there is no risk of data leakage, and your data is 100% private and secure. Affected versions of this packa...

SUSE CVE-2024-57603

An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion due to a missing maximum tree depth check in emitter functions. Remediation Upgrade rapidyaml to version 0.7.0 or higher. References - GitHub Commit - GitHub PR...

SUSE CVE-2023-5950

Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in...

GHSA-MPG8-8X9C-P9GV MaysWind ezBookkeeping has Improper Privilege Management

An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component...

ezBookkeeping 安全漏洞

ezBookkeeping is a lightweight personal bookkeeping application by mayswind individual developers. A security vulnerability exists in ezBookkeeping version 0.7.0, which stems from a lack of rate limiting, resulting in an elevation of privilege vulnerability...

ezBookkeeping 安全漏洞

ezBookkeeping is a lightweight personal bookkeeping application by mayswind individual developers. A security vulnerability exists in ezBookkeeping version 0.7.0, which stems from a vulnerability contained in the token component that results in an elevation of privilege vulnerability...

Deserialization of Untrusted Data

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the hfmodelweightsiterator process due to the usage of the torch.load function with the weightsonly parameter...

CVE-2025-24357

The CVE-2025-24357 issue centers on vLLM’s hf_model_weights_iterator (vllm/model_executor/weight_utils.py) which loads checkpoints via torch.load with weights_only defaulting to False. If malicious pickle data is unpickled, arbitrary code could execute on the host. This vulnerability is highlight...