15435 matches found
GHSA-V39H-62P7-JPJC vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips, serve, argo-workflows, tileserver-gl, prism, langfuse-fips, wazuh-dashboard, saf, vitess, langfuse, opensearch-dashboards-fips, opensearch-dashboards, kibana, keep, keep-fips, drupal, tileserver-gl-fips, arangodb,...
CVE-2026-6322 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips, serve, argo-workflows, tileserver-gl, prism, langfuse-fips, wazuh-dashboard, saf, vitess, langfuse, opensearch-dashboards-fips, opensearch-dashboards, kibana, keep, keep-fips, drupal, tileserver-gl-fips, arangodb,...
Drupal avatar_uploader 跨站脚本漏洞
Drupal avatarUploader is an extension developed by Drupal Corporation that provides website users with functionality for uploading and managing avatars. The Drupal avatarUploader 7.x-1.0-beta8 version contains a cross-site scripting vulnerability. This vulnerability stems from improper handling o...
PT-2026-39482
Name of the Vulnerable Software and Affected Versions avatar uploader version 7.x-1.0-beta8 Description A reflected cross-site scripting issue allows unauthenticated attackers to inject malicious scripts by manipulating the file parameter. Attackers can craft URLs containing script payloads in th...
GHSA-Q3J6-QGPJ-74H6 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips, serve, argo-workflows, tileserver-gl, prism, langfuse-fips, wazuh-dashboard, saf, vitess, langfuse, opensearch-dashboards-fips, opensearch-dashboards, kibana, keep, keep-fips, drupal, tileserver-gl-fips, arangodb,...
CVE-2026-6321 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips, serve, argo-workflows, tileserver-gl, prism, langfuse-fips, wazuh-dashboard, saf, vitess, langfuse, opensearch-dashboards-fips, opensearch-dashboards, kibana, keep, keep-fips, drupal, tileserver-gl-fips, arangodb,...
Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 1.0.317 Vulnerability Details CVEID:CVE-2025-15284 DESCRIPTION: Improper Input Validation vulnerability in qs parse modules allows HTTP DoS.This issue affects qs: 6.14.1. Summary The arrayLimit option ...
GHSA-V2V4-37R5-5V8G vulnerabilities
Vulnerabilities for packages: code-server, renovate, prism, tileserver-gl, actions-runner, langfuse-fips, kubeflow-katib, wazuh-dashboard, pulumi, saf, sqlpad, lerna, langfuse, opensearch-dashboards-fips, graalvm, gemini-cli, opensearch-dashboards, kibana, npm, tileserver-gl-fips, drupal,...
CVE-2026-42338 vulnerabilities
Vulnerabilities for packages: code-server, renovate, prism, tileserver-gl, actions-runner, langfuse-fips, kubeflow-katib, wazuh-dashboard, pulumi, saf, sqlpad, lerna, langfuse, opensearch-dashboards-fips, graalvm, gemini-cli, opensearch-dashboards, kibana, npm, tileserver-gl-fips, drupal,...
GHSA-QX2V-QP2M-JG93 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, renovate, homepage, jitsucom-jitsu, authentik-fips, langfuse-fips, kubeflow-katib, nextcloud-server, saf, vitess, authentik, py3-captum, langfuse, vite, keep, keep-fips, drupal, pelias-api...
CVE-2026-41305 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, renovate, homepage, jitsucom-jitsu, authentik-fips, langfuse-fips, kubeflow-katib, nextcloud-server, saf, vitess, authentik, py3-captum, langfuse, vite, keep, keep-fips, drupal, pelias-api...
CVE-2026-41907 vulnerabilities
Vulnerabilities for packages: code-server, gitlab-rails-ce, gitlab-rails-ce-fips, kubeflow-centraldashboard, renovate, homepage, jitsucom-jitsu, tensorflow-cpu-jupyter, redisinsight, argo-workflows, prism, actions-runner, langfuse-fips, kubeflow-katib, py3-jupyterlab, wazuh-dashboard, dbgate-fips...
GHSA-R7CG-QJJM-XHQQ webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
Summary GraphQL\Language\Parser is a recursive descent parser with no recursion depth limit and no zend.maxallowedstacksize interaction. Crafted nested queries trigger a SIGSEGV in the PHP runtime, killing the FPM/CLI worker process. Smallest crashing payload is approximately 74 KB. Affected...
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
Summary GraphQL\Language\Parser is a recursive descent parser with no recursion depth limit and no zend.maxallowedstacksize interaction. Crafted nested queries trigger a SIGSEGV in the PHP runtime, killing the FPM/CLI worker process. Smallest crashing payload is approximately 74 KB. Affected...
GHSA-FC86-6RV6-2JPM webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
Summary OverlappingFieldsCanBeMerged validation rule has On^2 x m^2 worst case via flattened inline fragments. The CVE-2023-26144 named-fragment cache does not cover inline fragments. A 364 KB query 200 outer x 100 inner inline fragments consumes 117 seconds of CPU per request, with no comparison...
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
Summary OverlappingFieldsCanBeMerged validation rule has On^2 x m^2 worst case via flattened inline fragments. The CVE-2023-26144 named-fragment cache does not cover inline fragments. A 364 KB query 200 outer x 100 inner inline fragments consumes 117 seconds of CPU per request, with no comparison...
GHSA-W5HQ-G745-H8PQ vulnerabilities
Vulnerabilities for packages: code-server, gitlab-rails-ce, gitlab-rails-ce-fips, kubeflow-centraldashboard, renovate, homepage, jitsucom-jitsu, tensorflow-cpu-jupyter, redisinsight, argo-workflows, prism, actions-runner, langfuse-fips, kubeflow-katib, py3-jupyterlab, wazuh-dashboard, dbgate-fips...
DRUPAL-CONTRIB-2026-033
This module enables you to obfuscate email addresses in content. The module doesn't sufficiently sanitize user input via the Twig filter. This vulnerability is mitigated by the fact that it only affects sites using the ROT13 encoding and where an attacker can enter content that is filtered using...
PT-2026-34625
Name of the Vulnerable Software and Affected Versions Obfuscate versions 0.0.0 through 2.0.1 Description Improper neutralization of input during web page generation allows Cross-Site Scripting XSS. The module, which obfuscates email addresses in content, fails to sufficiently sanitize user input...
Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033
This module enables you to obfuscate email addresses in content. The module doesn't sufficiently sanitize user input via the Twig filter. This vulnerability is mitigated by the fact that it only affects sites using the ROT13 encoding and where an attacker can enter content that is filtered using...