Insufficient Verification of Data Authenticity

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the WebSocket handshake process. An attacker can cause unauthorized frames to be decoded an...

Embedded Malicious Code

Overview tensorlake is a TensorLake SDK for applications, sandboxes, and cloud services Affected versions of this package are vulnerable to Embedded Malicious Code that contains a credential-stealing worm known as Shai-Hulud. A malicious actor used a repository administrator account to commit the...

Improper Isolation or Compartmentalization

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization via embed card previews in the Ghost editor, which bypass the prior fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including those with the Contributor role, can...

Insecure Temporary File

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Insecure Temporary File in the process that extracts and loads the native library via net.jpountz.util.Native.load. An attacker can execu...

Insecure Temporary File

Overview Affected versions of this package are vulnerable to Insecure Temporary File in the process that extracts and loads the native library via net.jpountz.util.Native.load. An attacker can execute arbitrary code by pre-creating a malicious file in a shared temporary directory, causing the...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the refill function when processing LZ4 block streams with stopOnEmptyBlock set to false. An attacker can cause a thread to terminate unexpectedly by providing a stream with a large number of consecutive empty...

Uncontrolled Recursion

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Uncontrolled Recursion in the refill function when processing LZ4 block streams with stopOnEmptyBlock set to false. An attacker can cause...

Allocation of Resources Without Limits or Throttling

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through repeated allocation of large buffers in the LZ4FrameInputStream.readHeader...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through repeated allocation of large buffers in the LZ4FrameInputStream.readHeader process. An attacker can cause excessive CPU and garbage collection usage by providing specially...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via cross-request deduplication in the 'use cache' mechanism, where draft mode state is not accounted for when sharing cached fills between concurrent requests. A...

Origin Validation Error

Overview next is a react framework. Affected versions of this package are vulnerable to Origin Validation Error via the MCP middleware get-mcp-middleware.ts and the cross-site dev request blocker block-cross-site-dev.ts, which fail to adequately validate the request origin against the host. An...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys in the server's route caching logic in base-server.ts. Because cache keys are not bound to their source route, a...

SQL Injection

Overview @payloadcms/db-sqlite is a The officially supported SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are interpolat...

SQL Injection

Overview @payloadcms/db-postgres is a The officially supported Postgres database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are...

SQL Injection

Overview @payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are...

SQL Injection

Overview @payloadcms/db-vercel-postgres is a Vercel Postgres adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are interpolated into SQL...

Partial String Comparison

Overview Affected versions of this package are vulnerable to Partial String Comparison via the isPublicAdminRoute utility in packages/next/src/utilities/isPublicAdminRoute.ts, which incorrectly marks any route containing the substring /verify/ as a public admin route, regardless of whether it...

Missing Authorization

Overview @payloadcms/plugin-multi-tenant is a Multi Tenant plugin for Payload Affected versions of this package are vulnerable to Missing Authorization via the tenant field write path in tenantField/index.ts, where tenant membership is not enforced on create or update operations. An authenticated...

Origin Validation Error

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Origin Validation Error via getExternalFile in packages/payload/src/uploads/getExternalFile.ts, where the origin of an external file request URL is not validate...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-gcs is a Payload storage adapter for Google Cloud Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker c...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-s3 is a Payload storage adapter for Amazon S3 Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can upload a...

Cross-site Scripting (XSS)

Overview @payloadcms/payload-cloud is a The official Payload Cloud plugin Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can upload a...

Cross-site Scripting (XSS)

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-uploadthing is a Payload storage adapter for uploadthing Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker ca...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-azure is a Payload storage adapter for Azure Blob Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker c...

Incorrect Authorization

Overview @payloadcms/plugin-multi-tenant is a Multi Tenant plugin for Payload Affected versions of this package are vulnerable to Incorrect Authorization via the tenantField default value logic in packages/plugin-multi-tenant/src/fields/tenantField/index.ts, where the return value of...

External Control of File Name or Path

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to External Control of File Name or Path via the deleteAssociatedFiles function in packages/payload/src/uploads/deleteAssociatedFiles.ts, where a filename stored i...

Overly Restrictive Account Lockout Mechanism

Overview Affected versions of this package are vulnerable to Overly Restrictive Account Lockout Mechanism via the resetPassword operation, which fails to reset the account lockout state upon a successful password reset. An attacker who triggers repeated failed login attempts to lock an account ca...

Overly Restrictive Account Lockout Mechanism

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Overly Restrictive Account Lockout Mechanism via the resetPassword operation, which fails to reset the account lockout state upon a successful password reset. A...

Overly Restrictive Account Lockout Mechanism

Overview @payloadcms/drizzle is an A library of shared functions used by different payload database adapters Affected versions of this package are vulnerable to Overly Restrictive Account Lockout Mechanism via the resetPassword operation, which fails to reset the account lockout state upon a...

Arbitrary File Upload

Overview @payloadcms/storage-azure is a Payload storage adapter for Azure Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relat...

Arbitrary File Upload

Overview @payloadcms/storage-gcs is a Payload storage adapter for Google Cloud Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relat...

Arbitrary File Upload

Overview @payloadcms/payload-cloud is a The official Payload Cloud plugin Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related file-type...

Arbitrary File Upload

Overview @payloadcms/storage-uploadthing is a Payload storage adapter for uploadthing Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relate...

Arbitrary File Upload

Overview @payloadcms/storage-s3 is a Payload storage adapter for Amazon S3 Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related file-type...

Arbitrary File Upload

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData an...

Arbitrary File Upload

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related...

Arbitrary Code Injection

Overview @payloadcms/plugin-form-builder is a Form builder plugin for Payload CMS Affected versions of this package are vulnerable to Arbitrary Code Injection via insufficient access control on the FormSubmissions and Forms collections, where the read access check only verifies that a user is...

Missing Authorization

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Missing Authorization via the reorder endpoint in packages/payload/src/config/orderable/index.ts, where access control checks on update operations are...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via getFieldsToSign in the JWT authentication layer, where user-controlled fields...

Improper Verification of Cryptographic Signature

Overview @backstage/plugin-auth-backend-module-cloudflare-access-provider is a The cloudflare-access-provider backend module for the auth plugin. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the jwtVerify call in helpers.ts, which verifi...

Server-side Request Forgery (SSRF)

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unsanitized MkDocs plugin entries in mkdocs.yml during...

Incorrect Authorization

Overview @backstage/plugin-proxy-backend is an A Backstage backend plugin that helps you set up proxy endpoints in the backend Affected versions of this package are vulnerable to Incorrect Authorization via inconsistent application of route credentials in the proxy router...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the getLocationEntity method and the event-driven update path in BitbucketServerEntityProvider.ts, where repository filters projectKey, repoSlug, and skipArchivedRepos configured by an administrator are appli...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the apiBaseUrl input parameter in the createSentryCreateProjectAction and fetchDSN scaffolder actions, which previously accepted an arbitrary caller-supplied URL without validating it against the...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the TIFF CCITT Group 4 T6 encoding process. An attacker can cause process termination and denial of service by supplying a specially crafted 1x1 Group 4 TIFF image that, when decoded and re-encoded, triggers...

Sensitive Information in Resource Not Removed Before Reuse

Overview Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse in the ExrDecoderCore process when handling ZIP-compressed OpenEXR images. An attacker can access sensitive memory contents from prior operations by submitting a crafted image...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the ICC color profile conversion process when handling a malformed embedded ICC LUT16 profile with more than four output channels. An attacker can cause memory corruption and application termination by supplying a...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop through the ReadValues64 process. An attacker can cause the decoder to enter a non-progressing loop by supplying a crafted BigTIFF file with a large IFD entry count, resulting in excessive resource consumption and potentia...