Security advisories

high2024-11-06

CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data

cometbft/cometbft · GHSA-p7mv-53f2-4cwj

critical2024-11-06

CVE-2024-51757-happy-dom allows for server side code to be executed by a <script> tag

capricorn86/happy-dom · GHSA-96g7-g7g9-jxw8

high2024-11-06

CVE-2024-51736-Symfony vulnerable to command execution hijack on Windows with Process class

symfony/symfony · GHSA-qq5c-677p-737q

low2024-11-06

CVE-2024-50345-Symfony vulnerable to open redirect via browser-sanitized URLs

symfony/symfony · GHSA-mrqx-rp3w-jpjp

low2024-11-06

CVE-2024-50343-Symfony has an incorrect response from Validator when input ends with `\n`

symfony/symfony · GHSA-g3rh-rrhp-jhh9

low2024-11-06

CVE-2024-50342-Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient

symfony/symfony · GHSA-9c3x-r3wp-mgxm

low2024-11-06

CVE-2024-50341-Symfony's `Security::login` does not take into account custom `user_checker`

symfony/symfony · GHSA-jxgr-3v7q-3w9v

medium2024-11-06

CVE-2024-50340-Symfony allows changing the environment through a query

symfony/symfony · GHSA-x8vp-gf4q-mw5j

medium2024-11-06

CVE-2024-9902-ansible-core Incorrect Authorization vulnerability

ansible/ansible · GHSA-32p4-gm2c-wmch

low2024-11-05

CVE-2024-51756-cap-std doesn't fully sandbox all the Windows device filenames

bytecodealliance/cap-std · GHSA-hxf5-99xg-86hw

low2024-11-05

CVE-2024-51745-Wasmtime doesn't fully sandbox all the Windows device filenames

bytecodealliance/wasmtime · GHSA-c2f5-jxjv-2hh8

high2024-11-05

CVE-2024-51132-HAPI FHIR XML External Entity (XXE) vulnerability

hapifhir/org.hl7.fhir.core · GHSA-4cf2-cxp3-rjr7

low2024-11-05

CVE-2024-51753-@workos-inc/authkit-remix refresh tokens are logged when the debug flag is enabled

workos/authkit-remix · GHSA-v2qh-f584-6hj8

low2024-11-05

CVE-2024-51752-@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

workos/authkit-nextjs · GHSA-5wmg-9cvh-qw25

low2024-11-05

CVE-2024-51746-gitsign may use incorrect Rekor entries during verification

sigstore/gitsign · GHSA-8pmp-678w-c8xx

critical2024-11-05

CVE-2024-51735-Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE

j3ssie/osmedeus · GHSA-wvv7-wm5v-w2gv

medium2024-11-05

CVE-2024-51493-OctoPrint has API key access in settings without reauthentication

octoprint/octoprint · GHSA-cc6x-8cc7-9953

medium2024-11-05

CVE-2024-49377-OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates

octoprint/octoprint · GHSA-xvxq-g8hw-fx4g

low2024-11-05

CVE-2024-48057-LocalAI Cross-site Scripting vulnerability

mudler/localai · GHSA-ghx4-cgxw-7h9p

high2024-11-05

CVE-2024-48050-AgentScope uses `eval`

modelscope/agentscope · GHSA-6p55-qr3j-mpgq