Security advisories

medium2024-10-15

CVE-2024-41128-Possible ReDoS vulnerability in query parameter filtering in Action Dispatch

rails/rails · GHSA-x76w-6vjr-8xgj

medium2024-10-15

CVE-2024-44337-Infinite loop in github.com/gomarkdown/markdown

gomarkdown/markdown · GHSA-xhr3-wf7j-h255

high2024-10-15

CVE-2024-21272-MySQL Connector/Python connector takeover vulnerability

mysql/mysql-connector-python · GHSA-hgjp-83m4-h4fj

critical2024-10-15

CVE-2024-9486-VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder

kubernetes-sigs/image-builder · GHSA-9224-ggvw-wh7v

low2024-10-15

CVE-2024-9506-ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function

vuejs/core · GHSA-5j4c-8p2g-v4jx

high2024-10-15

CVE-2024-47874-Starlette Denial of service (DoS) via multipart/form-data

encode/starlette · GHSA-f96h-pmfr-66vw

high2024-10-15

CVE-2024-47824-Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room

matrix-org/matrix-react-sdk · GHSA-qcvh-p9jq-wp8v

high2024-10-15

CVE-2024-47080-Matrix JavaScript SDK's key history sharing could share keys to malicious devices

matrix-org/matrix-js-sdk · GHSA-4jf8-g8wp-cx7c

critical2024-10-15

CVE-2024-32651-changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

dgtlmoon/changedetection.io · GHSA-4r7v-whpg-8rx3

critical2024-10-15

CVE-2024-48914-Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

vendure-ecommerce/vendure · GHSA-r9mq-3c9r-fmjq

medium2024-10-15

CVE-2024-48913-Hono allows bypass of CSRF Middleware by a request without Content-Type header.

honojs/hono · GHSA-2234-fmw7-43wr

high2024-10-15

CVE-2024-48915-Agent Dart is missing certificate verification checks

astroxnetwork/agent_dart · GHSA-fmj7-7gfw-64pg

low2024-10-15

CVE-2024-48948-Valid ECDSA signatures erroneously rejected in Elliptic

indutny/elliptic · GHSA-fc9h-whq2-v747

medium2024-10-15

CVE-2024-9979- PyO3 has a risk of use-after-free in `borrowed` reads from Python weak references

pyo3/pyo3 · GHSA-6jgw-rgmm-7cv6

high2024-10-15

CVE-2024-47876-SAK-50571 Sakai Kernel users created with type roleview can login as a normal user

sakaiproject/sakai · GHSA-cx95-q6gx-w4qp

medium2024-10-15

CVE-2024-21535-Cross site scripting in markdown-to-jsx

quantizor/markdown-to-jsx · GHSA-4wx3-54gh-9fr9

medium2024-10-14

CVE-2024-48911-OpenCanary Executes Commands From Potentially Writable Config File

thinkst/opencanary · GHSA-pf5v-pqfv-x8jj

medium2024-10-14

CVE-2024-6763-Eclipse Jetty URI parsing of invalid authority

jetty/jetty.project · GHSA-qh8g-58pp-2wxh

medium2024-10-14

CVE-2024-8184-Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

jetty/jetty.project · GHSA-g8m5-722r-8whq

low2024-10-14

CVE-2024-6762-Eclipse Jetty's PushSessionCacheFilter can cause remote DoS attacks

jetty/jetty.project · GHSA-r7m4-f9h5-gr79