Security advisories

medium2024-09-23

CVE-2024-47066-lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

lobehub/lobe-chat · GHSA-3fc8-2r3f-8wrg

high2024-09-23

CVE-2024-46985-DataEase has an XML External Entity Reference vulnerability

dataease/dataease · GHSA-4m9p-7xg6-f4mm

critical2024-09-23

CVE-2024-46997-DataEase's H2 datasource has a remote command execution risk

dataease/dataease · GHSA-h7mj-m72h-qm8w

high2024-09-23

CVE-2024-9014-OAuth2 client ID and secret exposed through the web browser

pgadmin-org/pgadmin4 · GHSA-jm9x-rx9x-wpqj

high2024-09-22

CVE-2024-47220-HTTP Request Smuggling in ruby webrick

ruby/webrick · GHSA-6f62-3596-g6w7

medium2024-09-20

CVE-2024-45793-Prevent XSS from Confidant API call

lyft/confidant · GHSA-rxq8-q85f-m866

critical2024-09-20

CVE-2024-47062-Navidrome has Multiple SQL Injections and ORM Leak

navidrome/navidrome · GHSA-58vj-cv5w-v4v6

high2024-09-20

CVE-2024-47061-Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes

udecode/plate · GHSA-73rg-f94j-xvhx

medium2024-09-20

CVE-2024-45614-Puma's header normalization allows for client to clobber proxy set headers

puma/puma · GHSA-9hf4-67fc-4vf4

medium2024-09-19

CVE-2024-8375-Reverb use after free vulnerability

google-deepmind/reverb · GHSA-w69q-w4h4-2fx8

medium2024-09-19

DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS

web-infra-dev/rspack · GHSA-84jw-g43v-8gjm

high2024-09-19

CVE-2024-47060-ZITADEL Allows Unauthorized Access After Organization or Project Deactivation

zitadel/zitadel · GHSA-jj94-6f5c-65r8

high2024-09-19

CVE-2024-47000-ZITADEL's Service Users Deactivation not Working

zitadel/zitadel · GHSA-qr2h-7pwm-h393

high2024-09-19

CVE-2024-46999-ZITADEL's User Grant Deactivation not Working

zitadel/zitadel · GHSA-2w5j-qfvw-2hf5

high2024-09-19

CVE-2024-7254-protobuf-java has potential Denial of Service issue

protocolbuffers/protobuf · GHSA-735f-pc8j-v9w8

high2024-09-19

CVE-2024-46984-Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack

gematik/app-referencevalidator · GHSA-68j8-fp38-p48q

high2024-09-19

CVE-2024-46983-SOFA Hessian Remote Command Execution (RCE) Vulnerability

sofastack/sofa-hessian · GHSA-c459-2m73-67hj

critical2024-09-19

CVE-2024-45410-HTTP client can manipulate custom HTTP headers that are added by Traefik

traefik/traefik · GHSA-62c8-mh53-4cqv

critical2024-09-19

CVE-2023-27584-Dragonfly2 has hard coded cyptographic key

dragonflyoss/dragonfly2 · GHSA-hpc8-7wpm-889w

critical2024-09-19

CVE-2024-8986-Grafana plugin SDK Information Leakage

grafana/grafana-plugin-sdk-go · GHSA-xxxw-3j6h-q7h6