83 matches found
WS-2026-0031
NocoBase is vulnerable to authenticated remote code execution through two chained flaws in the server package. An authenticated admin can supply an unsanitized documentRoot value to the storages:update API to redirect the file-upload storage root to an arbitrary path on disk, including the...
GHSA-2V37-7H3G-55P8 vulnerabilities
Vulnerabilities for packages: pelias-api, homepage, unleash-fips, dotstatsuite-supercore, langfuse-fips, unleash, json-server, authentik, commercial-gitlab-rails-ee-fips, tensorflow-gpu-jupyter, keep-fips, vitess, vite, saf, renovate, jupyter-base-notebook, jitsucom-jitsu, arangodb,...
GHSA-8XCM-R25X-G524 vulnerabilities
Vulnerabilities for packages: langfuse, prism, saf, vitess, code-server, npm, renovate, pulumi...
GHSA-JR45-8VMC-QM54 vulnerabilities
Vulnerabilities for packages: vitess, code-server, renovate, langfuse...
[SECURITY] Fedora 43 Update: postgresql16-16.14-1.fc43
PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...
budibase (>=0.0.3, <=0.0.31) potentially affected by unknown CVE via @budibase/server (>=0.0.1, <=0.0.31)
@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: unknown CVE Source advisory: SNYK:JS-BUDIBASESERVER-18319709...
@grackle-ai/cli (>=0.19.0, <=0.132.1), @grackle-ai/server (>=0.19.0, <=0.132.1) potentially affected by unknown CVE via @grackle-ai/mcp (>=0.19.0, <=0.132.1)
@grackle-ai/mcp NPM version =0.19.0, =0.19.0, =0.19.0, =0.132.1 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIMCP-17817921...
GHSA-34XG-WGJX-8XPH vulnerabilities
Vulnerabilities for packages: nextcloud-server...
GHSA-VMF3-W455-68VH vulnerabilities
Vulnerabilities for packages: lerna, prism, homepage, graalvm, tileserver-gl-fips, pnpm-stage0, tensorflow-gpu-jupyter, tensorflow-cpu-jupyter, saf, thingsboard, renovate, py3-jupyterlab, thingsboard-fips, jupyter-base-notebook, kubeflow-katib, kibana, pulumi, drupal, opensearch-dashboards,...
GHSA-H67P-54HQ-RP68 vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, lerna, thingsboard, code-server, sqlpad, tileserver-gl, py3-jupyterlab, airflow, argo-workflows, eslint, langfuse, opensearch-dashboards, prism, saf, kubeflow-katib, renovate, ts-patch, kubeflow-pipelines, vitess, pulumi...
Authentication Bypass Using an Alternate Path or Channel
Overview github.com/traefik/traefik/v2/pkg/server is a server package for traefik, a cloud native edge router. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the StripPrefix process. An attacker can access protected backend endpoint...
CLEANSTART-2026-EA12165 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-26958, CVE-2026-27136, CVE-2026-27139, CVE-2026-27142, CVE-2026-27145, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-33816, CVE-2026-34986, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-42499, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-273p-m2cw-6833, ghsa-4c4x-jm2x-pf9j, ghsa-4qg8-fj49-pxjh, ghsa-846p-jg2w-w324, ghsa-fcv2-xgw5-pqxf, ghsa-fphv-w9fq-2525, ghsa-jqc5-w2xx-5vq4, ghsa-pmwq-pjrm-6p5r, ghsa-whqx-f9j3-ch6m, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.14.1-r0, 1.14.1-r1, 1.14.1-r2, 1.14.1-r3, 1.14.1-r4, 1.14.5-r0, 1.14.5-r1
Multiple security vulnerabilities affect the spire-server package. These issues are resolved in later releases. See references for individual vulnerability details...
@budibase/client (>=3.0.0, <=3.2.26), @budibase/server (>=3.0.0, <=3.2.26) potentially affected by CVE-2026-45716 via @budibase/frontend-core (>=3.0.0, <=3.2.26)
@budibase/frontend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-45716 Source advisory: SNYK:JS-BUDIBASEFRONTENDCORE-16759691...
GHSA-5RQ4-664W-9X2C vulnerabilities
Vulnerabilities for packages: code-server, langfuse, opensearch-dashboards...
@cubejs-backend/server (>=1.1.17, <=1.4.1), @cubejs-backend/testing-drivers (>=1.1.17, <=1.4.1) potentially affected by CVE-2026-25957 via @cubejs-backend/server-core (>=1.1.17, <=1.4.1)
@cubejs-backend/server-core NPM version =1.1.17, =1.1.17, =1.1.17, =1.4.1 Source cves: CVE-2026-25957 Source advisory: OSV:GHSA-9VPH-2HVM-X66G...
CLEANSTART-2026-AU31441 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate
Multiple security vulnerabilities affect the metrics-server-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...
GHSA-3F26-J6R7-9Q8V vulnerabilities
Vulnerabilities for packages: xorg-server...
GHSA-6RW7-VPXM-498P vulnerabilities
Vulnerabilities for packages: langfuse-fips, librechat, json-server, kubeflow-centraldashboard, tileserver-gl-fips, kubeflow-pipelines, redisinsight, tensorflow-gpu-jupyter, tensorflow-cpu-jupyter, argo-workflows, saf, thingsboard, renovate, py3-jupyterlab, jupyter-base-notebook, kubeflow-katib,...
