Security advisories

low2024-10-14

CVE-2024-48909-SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not

authzed/spicedb · GHSA-3c32-4hq9-6wgj

medium2024-10-14

CVE-2024-7318-Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity

keycloak/keycloak · GHSA-xmmm-jw76-q7vg

high2024-10-14

CVE-2024-7341-Keycloak has session fixation in Elytron SAML adapters

keycloak/keycloak · GHSA-5rxp-2rhr-qwqv

medium2024-10-14

CVE-2024-8883-Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect

keycloak/keycloak · GHSA-w8gr-xwp4-r9f7

high2024-10-14

CVE-2024-8698-Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak

keycloak/keycloak · GHSA-xgfv-xpx8-qhcr

low2024-10-14

Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly

landlock-lsm/go-landlock · GHSA-vv6c-69r6-chg9

medium2024-10-14

CVE-2024-47885-DOM Clobbering Gadget found in astro's client-side router that leads to XSS

withastro/astro · GHSA-m85w-3h95-hcf9

medium2024-10-14

CVE-2024-47831-Denial of Service condition in Next.js image optimization

vercel/next.js · GHSA-g77x-44xx-532m

medium2024-10-14

CVE-2024-46528-KubeSphere IDOR vulnerability

kubesphere/kubesphere · GHSA-p26r-gfgc-c47h

high2024-10-14

CVE-2023-50780-Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans

apache/activemq-artemis · GHSA-443j-grxv-2pgv

medium2024-10-14

CVE-2024-9823-Eclipse Jetty has a denial of service vulnerability on DosFilter

jetty/jetty.project · GHSA-j26w-f9rq-mr2q

critical2024-10-11

CVE-2023-25581-pac4j-core affected by a Java deserialization vulnerability

pac4j/pac4j · GHSA-76mw-6p95-x9x5

medium2024-10-11

CVE-2024-6985-Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint

parisneo/lollms · GHSA-6h64-g7cj-hj56

critical2024-10-11

CVE-2024-42640-angular-base64-upload vulnerable to unauthenticated remote code execution

adonespitogo/angular-base64-upload · GHSA-vgxq-6rcf-qwrw

medium2024-10-11

CVE-2024-47877-Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.

codeclysm/extract · GHSA-8rm2-93mq-jqhc

high2024-10-11

CVE-2024-47875-DOMpurify has a nesting-based mXSS

cure53/dompurify · GHSA-gx9m-whjm-85jf

critical2024-10-11

CVE-2024-47832-SSOReady has an XML Signature Bypass via differential XML parsing

ssoready/ssoready · GHSA-j2hr-q93x-gxvh

critical2024-10-11

CVE-2024-21534-JSONPath Plus Remote Code Execution (RCE) Vulnerability

jsonpath-plus/jsonpath · GHSA-pppg-cpfq-h7wr

low2024-10-11

CVE-2024-6971-Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py

parisneo/lollms · GHSA-7pgr-32fx-c6x9

high2024-10-11

CVE-2024-48987-Snipe-IT remote code execution

snipe/snipe-it · GHSA-57qh-vmjr-5jxg