144022 matches found
GHSA-74XJ-WH4W-VQXC dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS default 64 and DDTRACEBAGGAGEMAXBYTES default 8192 limits were applied only to baggage...
CVE-2026-54450
creationtimestamp| type| source ---|---|--- 2026-07-15 22:35:03+00:00| published-proof-of-concept| https://github.com/stacklok/toolhive/security/advisories/GHSA-pph6-vfjv-vpjw...
CVE-2026-38974
Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3506 more potentially affected by CVE-2026-54490 via websocket-driver (>=0.3.5, <=0.7.4)
websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54490 Source advisory: OSV:GHSA-MP7J-QC5W-4988...
GHSA-MP7J-QC5W-4988 websocket-driver: Resource limit bypass via message compression
Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the si...
Improper Handling of Length Parameter Inconsistency
Overview websocket-driver is a websocket protocol handler with pluggable I/O. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency through the hybi.js WebSocket frame processing in lib/websocket/driver. An attacker can corrupt how the server pars...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3506 more potentially affected by CVE-2026-54466 via websocket-driver (>=0.3.5, <=0.7.4)
websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54466 Source advisory: SNYK:JS-WEBSOCKETDRIVER-17987994...
CVE-2026-54494
creationtimestamp| type| source ---|---|--- 2026-07-15 20:35:03+00:00| published-proof-of-concept| https://github.com/koel/koel/security/advisories/GHSA-rjg7-r26h-cfp2...
GHSA-Q3FV-X8VG-QQM4 vulnerabilities
Vulnerabilities for packages: trivy-operator...
GHSA-58W9-8G37-X9V5 vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GHSA-39PV-4J6C-2G6V vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GHSA-692R-GRFM-V8X7 vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GHSA-79CF-XCQC-C78W vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GHSA-48R7-HPM6-GFXM vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GHSA-CVF9-G74C-VV79 vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GHSA-FQPX-62JV-7R6R vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GHSA-JRMJ-C5CX-3CW6 vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
GHSA-M3HQ-GRV6-H853 vulnerabilities
Vulnerabilities for packages: kubeflow-katib...