Security advisories

high2024-12-05

CVE-2024-52798-path-to-regexp contains a ReDoS

pillarjs/path-to-regexp · GHSA-rhx6-c78j-4q9w

medium2024-12-05

CVE-2024-54128-Directus has an HTML Injection in Comment

directus/directus · GHSA-r6wx-627v-gh2f

low2024-12-05

CVE-2024-54140-sigstore-java has a vulnerability with bundle verification

sigstore/sigstore-java · GHSA-jp26-88mw-89qr

medium2024-12-05

Build corruption when using `PYO3_CONFIG_FILE` environment variable

pyo3/pyo3 · GHSA-vxcf-c7mx-pg53

low2024-12-05

Unsound usages of `std::slice::from_raw_parts`

tikv/pprof-rs · GHSA-gw5w-5j7f-jmjj

high2024-12-05

CVE-2024-53857-rPGP Potential Resource Exhaustion when handling Untrusted Messages

rpgp/rpgp · GHSA-4grw-m28r-q285

high2024-12-05

CVE-2024-53856-rPGP Panics on Malformed Untrusted Input

rpgp/rpgp · GHSA-9rmp-2568-59rv

high2024-12-05

CVE-2024-11941-Drupal core Denial of Service

drupal/core · GHSA-xq54-x54m-vcpx

medium2024-12-05

CVE-2024-11942-Drupal core vulnerable to improper error handling

drupal/core · GHSA-52jr-x6h6-xj6g

high2024-12-05

CVE-2022-41137-Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore

apache/hive · GHSA-6hqr-c69m-r76q

medium2024-12-04

CVE-2024-38829-Spring LDAP data exposure vulnerability

spring-projects/spring-ldap · GHSA-mqvr-2rp8-j7h4

low2024-12-04

CVE-2024-51210-Firepad allows insecure document access

firebaseextended/firepad · GHSA-4fh7-m2wx-6wfm

medium2024-12-04

op_panic in the base runtime can force a panic in the runtime's containing thread

bromeon/js-sandbox · GHSA-4mw5-2636-4535

high2024-12-04

CVE-2024-39163-pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints

binux/pyspider · GHSA-pqj8-xhcx-prxm

medium2024-12-04

Unsoundness in anstream

rust-cli/anstyle · GHSA-2rxc-gjrp-vjhx

high2024-12-04

Borsh serialization of HashMap is non-canonical

rust-lang/hashbrown · GHSA-wwq9-3cpr-mm53

low2024-12-04

linkme fails to ensure slice elements match the slice's declared type

dtolnay/linkme · GHSA-f95p-4cv5-8w8x

high2024-12-04

CVE-2024-54134-Modified package published to npm, containing malware that exfiltrates private key material

solana-labs/solana-web3.js · GHSA-jcxm-7wvp-g6p5

medium2024-12-04

CVE-2024-54132-Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability

cli/cli · GHSA-2m9h-r57g-45pj

high2024-12-03

CVE-2024-54131-Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3)

kolide/launcher · GHSA-66q9-2rvx-qfj5