10113 matches found
GHSA-8JVR-397X-XQH9 vulnerabilities
Vulnerabilities for packages: python...
CVE-2026-54285 vulnerabilities
Vulnerabilities for packages: pulumi, renovate, langfuse...
SUSE CVE-2026-49860
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially...
SUSE CVE-2026-50019
yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. At the file downloa...
SUSE CVE-2026-53540
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parseform did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded...
SUSE CVE-2026-54282
Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating scheme://hostpath and re-parsing the result, a path that does not begin with / for example...
CVE-2026-12322 vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-XP8H-82PC-F6JM vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-VMF3-W455-68VH vulnerabilities
Vulnerabilities for packages: gemini-cli, py3-captum, gitlab-rails-ce, pulumi, saf, thingsboard, tileserver-gl, tileserver-gl-fips, code-server, graalvm, gitlab-rails-ce-fips, thingsboard-fips, tensorflow-cpu-jupyter, pnpm-stage0, npm, wazuh-dashboard-fips, kubeflow-katib, sqlpad, py3-jupyterlab,...
GHSA-R7G4-QG5F-QQM2 vulnerabilities
Vulnerabilities for packages: langfuse...
GHSA-4X5R-PXFX-6JF8 vulnerabilities
Vulnerabilities for packages: kubeflow-katib, vitess, airflow, langfuse...
CVE-2026-12321 vulnerabilities
Vulnerabilities for packages: firefox...
CVE-2026-7210 vulnerabilities
Vulnerabilities for packages: python...
GHSA-993G-76C3-P5M4 vulnerabilities
Vulnerabilities for packages: superset, datadog-agent, kserve, ggshield...
SUSE CVE-2026-50133
Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html" had their body emitted verbatim...
SUSE CVE-2026-50269
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing...
CVE-2021-4435 vulnerabilities
Vulnerabilities for packages: yarn...
GHSA-MPWJ-FCR6-X34C vulnerabilities
Vulnerabilities for packages: yarn...