GO-2025-3540 vulnerabilities

Vulnerabilities for packages: gitea, splunk-otel-collector, authservice, fluent-bit-plugin-loki, atlantis, oauth2-proxy, kots, falcosidekick...

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint /authservice, PLL accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is...

CVE-2026-42565

@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is...

GHSA-6F52-WPX2-HVF2 vulnerabilities

Vulnerabilities for packages: fq, terraform-provider-acme, sftpgo-plugin-auth, skaffold, velero-plugin-for-aws, ghaudit, minify, wazero, flux-kustomize-controller, nri-cassandra, minio-operator, kubernetes-dashboard-auth, go, mkcert, kube-bench, restic, gobuster, nri-mongodb, spiffe-helper,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: fq, terraform-provider-acme, crane, velero-plugin-for-aws, ghaudit, wazero, flux-kustomize-controller, nri-cassandra, neuvector-scanner, minio-operator, kubernetes-dashboard-auth, mkcert, yam, kube-bench, restic, gobuster, distribution, nri-mongodb,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: fq, terraform-provider-acme, crane, velero-plugin-for-aws, ghaudit, wazero, flux-kustomize-controller, nri-cassandra, neuvector-scanner, minio-operator, kubernetes-dashboard-auth, mkcert, yam, kube-bench, restic, gobuster, distribution, nri-mongodb,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: octo-sts, emissary, thanos-operator, wazero-fips, distribution, conftest-fips, docker-cli, openbao-k8s-fips, syft, flux-kustomize-controller, redka, paranoia, harbor-fips, grafana-agent-operator, tfsec, crossplane-provider-azure-managedidentity, falco-exporter,...

CVE-2019-13983

Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...

CVE-2019-13983

Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...

CVE-2019-13983

Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php...