Security advisories

high2024-12-11

PQClean has a correctness error in HQC decapsulation

pqclean/pqclean · GHSA-753p-wrj5-g8fj

high2024-12-11

CVE-2024-55657-SiYuan has an arbitrary file read via /api/template/render

siyuan-note/siyuan · GHSA-xx68-37v4-4596

high2024-12-11

CVE-2024-55658-SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

siyuan-note/siyuan · GHSA-25w9-wqfq-gwqx

high2024-12-11

CVE-2024-55659-SiYuan has an arbitrary file write in the host via /api/asset/upload

siyuan-note/siyuan · GHSA-fqj6-whhx-47p7

medium2024-12-11

CVE-2024-55660-SiYuan has an SSTI via /api/template/renderSprig

siyuan-note/siyuan · GHSA-4pjc-pwgq-q9jp

medium2024-12-11

kcp's impersonation allows access to global administrative groups

kcp-dev/kcp · GHSA-c7xh-gjv4-4jgv

low2024-12-11

CVE-2024-55655-sigstore has insufficient validation of integration timestamp during verification

sigstore/sigstore-python · GHSA-hhfg-fwrw-87w7

critical2024-12-11

CVE-2024-53677-Apache Struts file upload logic is flawed

apache/struts · GHSA-43mq-6xmg-29vm

medium2024-12-10

CVE-2024-53866-pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion

pnpm/pnpm · GHSA-vm32-9rqf-rh3r

low2024-12-10

CVE-2024-54133-Possible Content Security Policy bypass in Action Dispatch

rails/rails · GHSA-vfm5-rmrh-j26v

high2024-12-10

CVE-2024-55500-Avenwu Whistle Cross-Site Request Forgery (CSRF)

avwo/whistle · GHSA-gg6x-448q-pqqm

medium2024-12-10

CosmWasm VM Incorrect metering

cosmwasm/wasmvm · GHSA-2q97-m5rc-p3gp

medium2024-12-10

Panic in wasmvm can slow down block production

cosmwasm/wasmvm · GHSA-vmqh-5232-v43r

low2024-12-10

Simulation of Wasmd message can cause crashing

cosmwasm/wasmd · GHSA-vmg2-r3xv-r3xf

critical2024-12-10

CVE-2024-54152-Angular Expressions - Remote Code Execution when using locals

peerigon/angular-expressions · GHSA-5462-4vcx-jh7j

high2024-12-10

CVE-2024-21542-luigi Arbitrary File Write via Archive Extraction (Zip Slip)

spotify/luigi · GHSA-8qch-vj6m-2694

high2024-12-10

CVE-2024-55637-Drupal core contains a potential PHP Object Injection vulnerability

drupal/core · GHSA-w6rx-9g2x-mg5g

high2024-12-10

CVE-2024-55638-Drupal core contains a potential PHP Object Injection vulnerability

drupal/core · GHSA-gvf2-2f4g-jqf4

low2024-12-10

CVE-2024-55636-Drupal core contains a potential PHP Object Injection vulnerability

drupal/core · GHSA-938f-5r4f-h65v

medium2024-12-10

CVE-2024-55634-Drupal core Access bypass

drupal/core · GHSA-7cwc-fjqm-8vh8