Security advisories

low2024-10-29

CVE-2024-8309-Langchain SQL Injection vulnerability

langchain-ai/langchain · GHSA-45pg-36p6-83v9

critical2024-10-29

CVE-2024-49768-Waitress has request processing race condition in HTTP pipelining with invalid first request

pylons/waitress · GHSA-9298-4cf8-g4wj

high2024-10-29

CVE-2024-48921-Kyverno's PolicyException objects can be created in any namespace by default

kyverno/kyverno · GHSA-qjvc-p88j-j9rm

high2024-10-29

CVE-2024-49769-Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion

pylons/waitress · GHSA-3f84-rpwh-47g6

medium2024-10-29

CVE-2024-50052-Mattermost server allows authenticated user to delete arbitrary post

mattermost/mattermost · GHSA-g376-m3h3-mj4r

medium2024-10-29

CVE-2024-45477-Apache NiFi Cross-site Scripting vulnerability

apache/nifi · GHSA-7mqj-xgf8-p59v

medium2024-10-29

CVE-2024-47401-Mattermost Server vulnerable to application crash from attacker-generated large response

mattermost/mattermost · GHSA-762v-rq7q-ff97

medium2024-10-29

CVE-2024-46872-Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery

mattermost/mattermost · GHSA-762g-9p7f-mrww

medium2024-10-29

CVE-2024-10241-Mattermost Server allows user to get private channel names

mattermost/mattermost · GHSA-6mvp-gh77-7vwh

low2024-10-28

CVE-2024-49755-Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs

duendesoftware/identityserver · GHSA-v9xq-2mvm-x8xc

medium2024-10-28

Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect')

coder/coder · GHSA-wcx9-ccpj-hx3c

medium2024-10-28

CVE-2024-49771-MPXJ has a Potential Path Traversal Vulnerability

joniles/mpxj · GHSA-j945-c44v-97g6

medium2024-10-28

CVE-2024-47827-Argo Workflows Controller: Denial of Service via malicious daemon Workflows

argoproj/argo-workflows · GHSA-ghjw-32xw-ffwr

low2024-10-28

CVE-2024-10214-Mattermost incorrectly issues two sessions when using desktop SSO

mattermost/mattermost · GHSA-hm57-h27x-599c

medium2024-10-28

CVE-2024-49761-REXML ReDoS vulnerability

ruby/rexml · GHSA-2rxp-v6pw-ch6m

high2024-10-28

CVE-2024-47821-pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

pyload/pyload · GHSA-w7hq-f2pj-c53g

critical2024-10-28

CVE-2024-38821-Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

spring-projects/spring-security · GHSA-c4q5-6c82-3qpw

medium2024-10-28

CVE-2024-50611-CycloneDX cdxgen may execute code contained within build-related files

cyclonedx/cdxgen · GHSA-hxf3-vgpm-fv9p

medium2024-10-26

CVE-2020-26311-useragent Regular Expression Denial of Service vulnerability

3rd-eden/useragent · GHSA-mgfv-m47x-4wqp

medium2024-10-26

CVE-2020-26303-insane vulnerable to Regular Expression Denial of Service

bevacqua/insane · GHSA-w455-mfq9-hf74