GHSA-J759-J44W-7FR8 vulnerabilities

Vulnerabilities for packages: actions-runner, arangodb, wazuh-dashboard, gitlab-rails-ce-fips, gitlab-rails-ce, sqlpad, librechat, wazuh-dashboard-fips, saf, npm...

CVE-2026-41673 vulnerabilities

Vulnerabilities for packages: actions-runner, arangodb, wazuh-dashboard, gitlab-rails-ce-fips, gitlab-rails-ce, sqlpad, librechat, wazuh-dashboard-fips, saf, npm...

CVE-2026-34601 vulnerabilities

Vulnerabilities for packages: arangodb, wazuh-dashboard, gitlab-rails-ce-fips, gitlab-rails-ce, sqlpad, wazuh-dashboard-fips, saf...

CVE-2019-25367

ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface index.html through search, user management, and API parameters. Attackers can inject scripts via parameters in /db/system/admin/aardvark/index.html to execute JavaScript i...

CVE-2019-25367

ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface (index.html). The issues allow injection of scripts via parameters in /_db/_system/_admin/aardvark/index.html, enabling JavaScript execution in authenticated users’ browse...

CVE-2019-25367 ArangoDB Community Edition 3.4.2-1 XSS via aardvark admin interface

ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface index.html through search, user management, and API parameters. Attackers can inject scripts via parameters in /db/system/admin/aardvark/index.html to execute JavaScript i...

EUVD-2019-19411

ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface index.html through search, user management, and API parameters. Attackers can inject scripts via parameters in /db/system/admin/aardvark/index.html to execute JavaScript i...

CVE-2019-25367

ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface index.html through search, user management, and API parameters. Attackers can inject scripts via parameters in /db/system/admin/aardvark/index.html to execute JavaScript i...

ai.catboost:catboost-spark_3.5_2.13 (>=1.2.3 <=1.2.10), ch.cern.sparkmeasure:spark-measure_2.13 (=0.24) +141 more potentially affected by CVE-2025-55039 via org.apache.spark:spark-network-common_2.13 (>=3.5.0 <=3.5.1)

org.apache.spark:spark-network-common2.13 MAVEN version =3.5.0, =1.2.3, =4.43.0, =3.5.0, =3.5.00.20.1, =3.5.0, =2.0.4, =2.1.6-spark-3.5.1, =2.1.6-spark-3.5.1, =1.1.1, =1.1.3 and more Source cves: CVE-2025-55039 Source advisory: OSV:GHSA-6P6V-M64V-JX8Q...

ai.catboost:catboost-spark_3.5_2.13 (>=1.2.3 <=1.2.10), ch.cern.sparkmeasure:spark-measure_2.13 (=0.24) +141 more potentially affected by CVE-2025-55039 via org.apache.spark:spark-network-common_2.13 (>=3.5.0 <=3.5.1)

org.apache.spark:spark-network-common2.13 MAVEN version =3.5.0, =1.2.3, =4.43.0, =3.5.0, =3.5.00.20.1, =3.5.0, =2.0.4, =2.1.6-spark-3.5.1, =2.1.6-spark-3.5.1, =1.1.1, =1.1.3 and more Source cves: CVE-2025-55039 Source advisory: SNYK:JAVA-ORGAPACHESPARK-13553869...

EUVD-2021-12795

Malware in sbrugna...

EUVD-2021-12796

Malware in sbrugna...

EUVD-2021-12797

Malware in sbrugna...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-fips, kyverno-policy-reporter, step, seaweedfs, pombump, flux-source-controller-fips, memcached-exporter, aws-node-termination-handler, argo-workflows, trust-manager-fips, aws-flb-cloudwatch-fips, kubernetes-replicator-fips, velero-fips,...

CVE-2021-25940

In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system...

CVE-2021-25938

In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting XSS, since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set, which makes it more susceptible for...

BIT-ARANGODB-2021-25940 ArangoDB - Insufficient Session Expiration after Password Change

In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system...

Malicious code in arangodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3e09e7451852efa7e3e9deea5dc6dd6e2cf678f5368a741c35b2eac846fff21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1769 Malicious code in arangodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3e09e7451852efa7e3e9deea5dc6dd6e2cf678f5368a741c35b2eac846fff21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview arangodb is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...