GHSA-M5XF-X7Q6-3RM7 KubeVela VelaUX APIserver has SSRF vulnerability

Impact Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. This issue is patched in 1.5.9 and 1.6.2. References Fix by: 50...

GHSA-8G2P-5PQH-5JMC .NET Information Disclosure Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework's System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages. A vulnerability exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a...

GHSA-3GFJ-FXX4-F22W OpenFGA Authorization Bypass

Overview During our internal security assessment, it was discovered that OpenFGA versions v0.2.4 and prior are vulnerable to authorization bypass under certain conditions. Am I Affected? You are affected by this vulnerability if you are using openfga/openfga version v0.2.4 or prior, and have tupl...

GO-2022-1086 Server-side request forger via X-Skipper-Proxy in github.com/zalando/skipper

An attacker can access the internal metadata server or other unauthenticated URLs by adding a specific header X-Skipper-Proxy to the http request...

GHSA-2JXG-MV2M-J4R7 Moodle type juggling vulnerability

An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability...

GHSA-9MMC-27GW-W6MQ Bytebase allows low-privilege users to view admin projects

Overview The "Bytebase" application does not restrict low privilege user from accessing admin projects Details The "Bytebase" application does not restrict low privilege user from accessing admin projects for which an unauthorized user can view the "projects" created by "Admin". The affected...

GHSA-9RWJ-9J2H-FHVM Toast UI Grid vulnerable to Cross-site Scripting

Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted content into editable cells. This issue was fixed in version 4.21.3. There are no known workarounds...

GHSA-936V-CG49-M2G5 com.google.cloud.tools:jib-core vulnerable to Remote Code Execution (RCE)

The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution RCE via the isDockerInstalled function, due to attempting to execute input...

GHSA-F92V-GRC2-W2FG Ethermint vulnerable to DoS through unintended Contract Selfdestruct

Vulnerability Report Impact Smart contract applications that make use of the selfdestruct functionality and their end-users. Classification The vulnerability has been classified as high with a CVSS score of 8.2. It has the potential to create a denial-of-service to all contracts that can invoke t...

GHSA-8RMH-55H4-93H5 DSpace ItemImportService API Vulnerable to Path Traversal in Simple Archive Format Package Import

Impact ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF simple archive format package could cause a file/directory to be created anywhere the Tomcat/DSpace user can write to on the server. However, this path traversal vulnerability is only possible...

GHSA-CJ7G-H7RF-H8J9 Apache Superset OS Command Injection

While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s os package in the web application process in versions 0.37.1. It was thus...

GHSA-MQR8-3V8J-46WV Missing Authorization in Jenkins Configuration as Code Plugin

Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins...

GHSA-W898-3PH8-5PGM Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response

Jenkins Swarm Plugin allows clients to auto-discover Jenkins instances on the same network through a UDP discovery request. Responses to this request are XML documents. Swarm Plugin does not configure the XML parser in a way that would prevent XML External Entity XXE processing. This allows...

GHSA-H6P6-FC4W-CQHX Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. dot dot in a resource URI...

GHSA-H2FP-XGX6-XH6F Pallets Werkzeug cross-site scripting vulnerability

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...

GHSA-WJP3-4XCQ-598P Apache Sling JCR ContentLoader XmlReader Arbitrary File Load

The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader...

GHSA-8WP2-VXPG-XCVP Cross site scripting in facturascripts

facturasripts is an open source ERP software. Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can...

GHSA-MJVC-J6RV-9XJ8 Insertion of Sensitive Information Into Debugging Code in Microweber

Microweber prior to 1.3 may expose sensitive information about a server and a user when running the server in debug mode...

GHSA-93P5-8FQW-WJX3 Authentication bypass by capture-replay in github.com/cosmos/ethermint

Cosmos Network Ethermint = v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application. Specific Go Packages Affected github.com/cosmos/ethermint/rpc/namespaces/eth...

GHSA-VFP4-XX6M-7VF6 Cryptographic Issues in ECK

Elastic Cloud on Kubernetes ECK versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK...

GHSA-6HV3-7C34-4HX8 Hashicorp Nomad Information Exposure Through Environmental Variables

In Nomad before version 0.9.5, when rendering a task template, all environment variables were available to the rendering task. As a fix, only task environment variables are used...

GHSA-C58C-W527-H77P Deserialization of untrusted data in Apache Cayenne

Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence ROP feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and...

GHSA-7F33-F4F5-XWGW In-band key negotiation issue in AWS S3 Crypto SDK for golang

Summary The golang AWS S3 Crypto SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the bucket in question, and that the attacker has access to an endpoint that reveals decryption failures without revealing the plaintext...

GHSA-JQMC-79GX-7G8P Incorrect Permission Assignment for Critical Resource in CRI-O

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace...

CVE-2022-0392 Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim prior to 8.2...

GHSA-X7WR-283H-5H2V Out-of-bounds Read in Onionshare

Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-014 - Vulnerability type: Out-of-bounds Read - Threat...

GHSA-2XW8-J43J-5VXP elgg is vulnerable to Cross-site Scripting

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

GHSA-C4RH-4376-GFF4 Improper certificate management in AWS IoT Device SDK v2

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority CA to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store...

DLA-2802-1 elfutils - security update

Bulletin has no description...

GHSA-536P-4PCJ-5MR9 raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...

GHSA-VQX7-PW4R-29RR Out of bounds read in bumpalo

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys...

GHSA-GV73-9MWV-FWGQ Out of bounds write in prost

Affected versions of this crate contained a bug in which decoding untrusted input could overflow the stack. On architectures with stack probes like x86, this can be used for denial of service attacks, while on architectures without stack probes like ARM overflowing the stack is unsound and can...

GHSA-HV87-47H9-JCVQ Uncontrolled recursion in rust-yaml

Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth...

GHSA-WVHV-RR3V-VHPJ Out-of-bounds write in ChakraCore

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829,...

GHSA-5WRH-4JWV-5W78 Open redirect via transitional IPv6 addresses on dual-stack networks

Impact Requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL...

DLA-2091-1 libjackson-json-java - security update

Bulletin has no description...

GHSA-4MVC-QC5W-V5QR Information disclosure in the Contao backend

Impact Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/information-disclosure-in-the-back-end For more information If...

DLA-1722-1 firefox-esr - security update

Bulletin has no description...

GHSA-6CPC-MJ5C-M9RQ Arbitrary File Write in cli

Affected versions of cli use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the cli process has permission to write to. Proof of Concept By...

UBUNTU-CVE-2018-1279

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports ...

DLA-359-1 mysql-5.5 - packages as an option announcement

Bulletin has no description...

CVE-2026-19001 MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to...

CVE-2026-70638 llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...

RHSA-2026:18683 Red Hat Security Advisory: libssh security update

Bulletin has no description...

GHSA-VXRR-W42W-W76G Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass

Summary Request::getMethod unconditionally honors the X-HTTP-Method-Override header and the $REQUEST'method' parameter on any HTTP verb including safe verbs such as GET, with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF...

CGA-CHWC-RC6R-V5HF

Bulletin has no description...

DEBIAN-CVE-2026-43860

mutt before 2.3.2 sometimes truncates the hashpasswd by one byte for IMAP authcram MD5 digest...

OSV-2026-609 Security exception in com.github.javaparser.ast.NodeList.forEach

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=504814677 Crash type: Security exception Crash state: com.github.javaparser.ast.NodeList.forEach com.github.javaparser.ast.visitor.VoidVisitorAdapter.visit...

CLEANSTART-2026-JK38734 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121 applied in versions: 1.80.1-r1

Multiple security vulnerabilities affect the prometheus-redis-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

MAL-2025-48945 Malicious code in terrastruct-d2-bin-win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bec005a1e4b23bc2e97201bde7e77e009276fac62af29f61c4c657a081d3f10 The package terrastruct-d2-bin-win32-x64 was found to contain malicious code...