GHSA-X574-M823-4X7W vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse...

CVE-2025-22870 affecting package vitess for versions less than 17.0.7-7

CVE-2025-22870 affecting package vitess for versions less than 17.0.7-7. A patched version of the package is available...

CBL Mariner 2.0 Security Update: vitess (CVE-2024-53257)

The version of vitess installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53257 advisory. - Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env...

CVE-2024-53257 affecting package vitess for versions less than 17.0.7-6

CVE-2024-53257 affecting package vitess for versions less than 17.0.7-6. A patched version of the package is available...

Vitess allows HTML injection in /debug/querylogz & /debug/env

...

CVE-2025-22868 affecting package vitess for versions less than 19.0.4-5

CVE-2025-22868 affecting package vitess for versions less than 19.0.4-5. A patched version of the package is available...

AZL-58443 CVE-2025-22870 affecting package vitess for versions less than 19.0.4-7

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

AZL-58402 CVE-2025-22870 affecting package vitess for versions less than 17.0.7-7

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

GHSA-968P-4WVH-CQC8 vulnerabilities

Vulnerabilities for packages: ts-patch, argo-workflows, gitlab-rails-ce-fips, opensearch-dashboards, prism, kibana, gitlab-rails-ce, jitsucom-jitsu, opensearch-dashboards-fips, kubeflow-katib...

CVE-2025-27789 vulnerabilities

Vulnerabilities for packages: ts-patch, argo-workflows, gitlab-rails-ce-fips, opensearch-dashboards, prism, kibana, gitlab-rails-ce, jitsucom-jitsu, opensearch-dashboards-fips, kubeflow-katib...

CVE-2025-22868 affecting package vitess for versions less than 17.0.7-5

CVE-2025-22868 affecting package vitess for versions less than 17.0.7-5. A patched version of the package is available...

AZL-57324 CVE-2025-22868 affecting package vitess for versions less than 19.0.4-5

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57425 CVE-2025-22868 affecting package vitess for versions less than 17.0.7-5

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

CVE-2024-45339 affecting package vitess for versions less than 17.0.7-4

CVE-2024-45339 affecting package vitess for versions less than 17.0.7-4. A patched version of the package is available...

Azure Linux 3.0 Security Update: sriov-network-device-plugin / vitess (CVE-2024-45339)

The version of sriov-network-device-plugin / vitess installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45339 advisory. - When logs are written to a widely-writable directory the default, an...

CBL Mariner 2.0 Security Update: sriov-network-device-plugin / vitess (CVE-2024-45339)

The version of sriov-network-device-plugin / vitess installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45339 advisory. - When logs are written to a widely-writable directory the default, an...

CVE-2024-45339 affecting package vitess for versions less than 19.0.4-4

CVE-2024-45339 affecting package vitess for versions less than 19.0.4-4. A patched version of the package is available...

CVE-2024-32886 affecting package vitess for versions less than 19.0.4-1

CVE-2024-32886 affecting package vitess for versions less than 19.0.4-1. A patched version of the package is available...

CVE-2024-32886 affecting package vitess for versions less than 17.0.7-1

CVE-2024-32886 affecting package vitess for versions less than 17.0.7-1. A patched version of the package is available...

AZL-56075 CVE-2024-45339 affecting package vitess for versions less than 17.0.7-4

When logs are written to a widely-writable directory the default, an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that...