Security advisories

medium2024-12-10

CVE-2024-12393-Drupal Core Cross-Site Scripting (XSS)

drupal/core · GHSA-8mvq-8h2v-j9vf

low2024-12-09

CVE-2024-6156-lxd CA certificate sign check bypass

canonical/lxd · GHSA-4c49-9fpc-hc3v

low2024-12-09

CVE-2024-6219-lxd has a restricted TLS certificate privilege escalation when in PKI mode

canonical/lxd · GHSA-jpmc-7p9c-4rxf

high2024-12-09

CVE-2024-53441-Bit flip attack vulnerability in cookie-encrypter

ebourmalo/cookie-encrypter · GHSA-h63v-hw6g-x8hp

medium2024-12-09

CVE-2024-46455-unstructured XML External Entity (XXE)

unstructured-io/unstructured · GHSA-32r8-54hf-c9p3

medium2024-12-09

CVE-2024-55601-Hugo does not escape some attributes in internal templates

gohugoio/hugo · GHSA-c2xf-9v2r-r2rx

high2024-12-09

league/commonmark's quadratic complexity bugs may lead to a denial of service

thephpleague/commonmark · GHSA-c2pc-g5qf-rfrf

high2024-12-09

CVE-2024-54149-Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

wintercms/winter · GHSA-xhw3-4j3m-hq53

medium2024-12-09

CVE-2024-12224-`idna` accepts Punycode labels that do not produce any non-ASCII when decoded

servo/rust-url · GHSA-h97m-ww89-6jmq

high2024-12-09

CVE-2024-54151-Directus allows unauthenticated access to WebSocket events and operations

directus/directus · GHSA-849r-qrwj-8rv4

medium2024-12-09

CVE-2024-53847-Trix editor subject to XSS vulnerabilities on copy & paste

basecamp/trix · GHSA-6vx4-v2jw-qwqh

low2024-12-09

CVE-2024-53947-Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

apache/superset · GHSA-92qf-8gh3-gwcm

high2024-12-09

CVE-2024-53949-Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

apache/superset · GHSA-35fc-9hrj-3585

medium2024-12-09

CVE-2024-53948-Apache Superset: Error verbosity exposes metadata in analytics databases

apache/superset · GHSA-2cx9-54hp-r698

medium2024-12-09

CVE-2024-55565-Predictable results in nanoid generation when given non-integer values

ai/nanoid · GHSA-mwcw-c2x4-8c55

low2024-12-06

shared_preferences_android vulnerability

flutter/packages · GHSA-3hpf-ff72-j67p

high2024-12-06

CVE-2024-54141-phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available

thorsten/phpmyfaq · GHSA-vrjr-p3xp-xx2x

high2024-12-06

CVE-2024-53908-Django SQL injection in HasKey(lhs, rhs) on Oracle

django/django · GHSA-m9g8-fxxm-xg86

medium2024-12-06

CVE-2024-53907-Django denial-of-service in django.utils.html.strip_tags()

django/django · GHSA-8498-2h75-472j

medium2024-12-06

CVE-2024-53457-LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section

librenms/librenms · GHSA-6c5q-fg3g-qhhv