[SECURITY] Fedora 43 Update: GitPython-3.1.55-1.fc43

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...

Uncontrolled Resource Consumption

github.com/pterodactyl/wings is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded JSON, YAML, and XML configuration file parsers in parser.go processing oversized non-file parser configuration data, which allows an attacker to exhaust the Wings process memory...

Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hcpx-6fm6-wx23. This link is maintained to preserve external references. Original Description axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-leve...

axios: axios: Information disclosure and data manipulation via prototype pollution

A flaw was found in axios. When the JavaScript environment's Object.prototype has been previously compromised through a technique known as prototype pollution, axios can inadvertently use malicious properties from nested configuration objects. This can lead to the silent injection of unauthorized...

CVE-2026-67310

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-67319 axios before 0.33.0 Prototype Pollution via nested option objects

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...

EUVD-2026-51809

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...

EUVD-2026-51827

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

CVE-2026-67310

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2026-67310 openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2025-14073

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

CVE-2025-14073 WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

CVE-2025-14073 WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

CVE-2025-14073

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

CVE-2025-14073

The CVE-2025-14073 entry concerns the WooCommerce PayPal Payments plugin for WordPress (affected versions up to 3.3.2). It describes an Insecure Direct Object Reference flaw in the enqueue_paypal_insights_script_on_order_received() function caused by missing validation on a user-controlled key. T...

EUVD-2025-210580

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

Exploit for CVE-2025-7384

CVE-2025-7384 — PHP Object Injection to RCE Plugin: Datab...

CVE-2026-18059

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

CVE-2025-14073: Authorization Bypass Through User-Controlled Key

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...