GO-2025-3719 Traefik allows path traversal using url encoding in github.com/traefik/traefik

Traefik allows path traversal using url encoding in github.com/traefik/traefik...

CVE-2025-47933 Argo CD allows cross-site scripting on repositories page

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve...

CVE-2019-25141

creationtimestamp| type| source ---|---|--- 2025-05-29 17:22:45+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2019/CVE-2019-25141.yaml 2025-05-31 21:02:17+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lqingbmgah2a 2026-05-23...

CVE-2024-4620

creationtimestamp| type| source ---|---|--- 2025-05-29 09:42:55+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-4620.yaml 2025-05-31 21:02:23+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lqingchywa2c...

Argo CD allows cross-site scripting on repositories page

Impact This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with...

argocd: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS)

A flaw was found in Argo CD, where improper filtering of repository URLs in the UI allows JavaScript injection. A crafted javascript: link can lead to cross-site scripting when viewed by another user. This can result in unauthorized API actions via the victim's session...

Cross-site Scripting (XSS)

Overview github.com/argoproj/argo-cd/v2/ui is a declarative, GitOps continuous delivery tool for Kubernetes. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper filtering of repository URLs in the UI. An attacker can execute unauthorized API actions via th...

PT-2025-23137 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to v2.13.8 Argo CD versions prior to v2.14.13 Argo CD versions prior to v3.0.4 Description: This issue allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, an...

GO-2025-3707 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

CVE-2025-3704

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DBAR Productions Volunteer Sign Up Sheets allows Stored XSS.This issue affects Volunteer Sign Up Sheets: from n/a before 5.5.5. The patch is available exclusively on GitHub at...

CVE-2023-38879

creationtimestamp| type| source ---|---|--- 2025-05-27 08:09:41+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-38879.yaml 2025-05-27 21:02:16+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lq6lkkrkoi22...

GO-2025-3702 Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env

Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env...

GO-2025-3700 Character injection in Hubble CLI in github.com/cilium/hubble

Character injection in Hubble CLI in github.com/cilium/hubble...

GO-2025-3699 Allows host filesystem access on pull in github.com/containerd/containerd

Allows host filesystem access on pull in github.com/containerd/containerd...

GO-2025-3694 Mattermost Fails to Check User Access to `ExperimentalSettings` in github.com/mattermost/mattermost-server

Mattermost Fails to Check User Access to ExperimentalSettings in github.com/mattermost/mattermost-server...

CVE-2025-22130

Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without...

CVE-2024-6971

A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the lollmsfilesystem.py file. The functions addragdatabase, togglemountragdatabase, and vectorizefolder do not implement security measures such as sanitizepathfromendpoint or sanitizepath. This allows a...

CVE-2024-5764

Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database SMTP or HTTP proxy credentials, user tokens, tokens, among others. The affected versions relied on ...

CVE-2024-45237

An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a trusted Trust Anchor can serve via rsync or RRDP a resource certificate containing a Key Usage extension composed of more than two bytes of data. Fort writes this string into a 2-byte buffer without...

CVE-2024-45236

An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a trusted Trust Anchor can serve via rsync or RRDP a signed object containing an empty signedAttributes field. Fort accesses the set's elements without sanitizing it first. Because Fort is an RPKI Relying...