300583 matches found
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
Summary When creating a MongoDB datasource, Budibase passes the tlsCertificateKeyFile and tlsCAFile fields straight to the MongoDB driver as server-side file paths. On Budibase Cloud a customer cannot place files on the server, so these fields only let a builder reference arbitrary absolute paths...
Information Exposure
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure in the handling of the tlsCertificateKeyFile and tlsCAFile fields, which are passed directly as filesystem paths to the MongoDB driver without validation or restriction. An...
Information Exposure
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure via the metadata endpoints, which fail to sanitize sensitive fields from user profiles. An attacker can obtain OAuth2 access and refresh tokens belonging to other users by...
Incorrect Authorization
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Incorrect Authorization via the assign process. An attacker can gain unauthorized access to other applications and assign elevated roles to themselves or other users by exploiting insufficient...
Allocation of Resources Without Limits or Throttling
Overview react-server-dom-parcel is a React Server Components bindings for DOM using Parcel. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling...
NPM: react-server-dom: Denial of Service in Server Functions
NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-turbopack versions = 19.0.0, 19.0.8...
Allocation of Resources Without Limits or Throttling
Overview react-server-dom-webpack is a React Server Components bindings for DOM using Webpack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttli...
react-server-dom: Denial of Service in Server Functions
Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7,...
Allocation of Resources Without Limits or Throttling
Overview react-server-dom-turbopack is a React Server Components bindings for DOM using Turbopack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...
NPM: react-server-dom: Denial of Service in Server Functions
NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-webpack versions = 19.0.0, 19.0.8...
EUVD-2026-46307
react-server-dom: Denial of Service in Server Functions...
NPM: react-server-dom: Denial of Service in Server Functions
NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-parcel versions = 19.1.0, 19.1.9...
GHSA-WX67-QW84-CM4G react-server-dom: Denial of Service in Server Functions
Impact A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7,...
GHSA-FRVJ-C5QP-XJ4W open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...
CVE-2026-65899 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, librechat, kibana, nextcloud-server, langfuse-fips, wazuh-dashboard-fips, wazuh-dashboard, langfuse...
CVE-2026-65903 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, librechat, kibana, opensearch-dashboards-fips, nextcloud-server, langfuse-fips, wazuh-dashboard-fips, wazuh-dashboard, langfuse...
CVE-2026-65898 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, librechat, kibana, opensearch-dashboards-fips, nextcloud-server, langfuse-fips, wazuh-dashboard-fips, wazuh-dashboard, langfuse...
CVE-2026-65900 vulnerabilities
Vulnerabilities for packages: librechat, kibana, nextcloud-server, langfuse-fips, wazuh-dashboard-fips, wazuh-dashboard, langfuse...