Security advisories

medium2024-09-09

CVE-2024-7260-Keycloak Open Redirect vulnerability

keycloak/keycloak · GHSA-g4gc-rh26-m3p5

medium2024-09-09

CVE-2024-45411-Twig has a possible sandbox bypass

twigphp/twig · GHSA-6j75-5wfj-gh66

high2024-09-09

CVE-2024-45296-path-to-regexp outputs backtracking regular expressions

pillarjs/path-to-regexp · GHSA-9wv6-86v2-598j

medium2024-09-09

CVE-2024-45406-Craft CMS vulnerable to stored XSS in breadcrumb list and title fields

craftcms/cms · GHSA-28h4-788g-rh42

medium2024-09-09

Httpful is Missing Certificate Validation

nategood/httpful · GHSA-gcfg-hmwx-wq5h

critical2024-09-09

CVE-2024-39205-pyload-ng vulnerable to RCE with js2py sandbox escape

pyload/pyload · GHSA-r9pp-r4xf-597r

high2024-09-09

CVE-2024-45041-External Secrets Operator vulnerable to privilege escalation

external-secrets/external-secrets · GHSA-qwgc-rr35-h4x9

low2024-09-09

CVE-2024-8373-AngularJS allows attackers to bypass common image source restrictions

angular/angular.js · GHSA-mqm9-c95h-x2p6

low2024-09-09

CVE-2024-8372-AngularJS allows attackers to bypass common image source restrictions

angular/angular.js · GHSA-m9gf-397r-hwpg

medium2024-09-08

CVE-2024-8572-Gouniverse GoLang CMS vulnerable to Cross-site Scripting

gouniverse/cms · GHSA-pv7h-hg6m-82j8

high2024-09-07

CVE-2024-45498-Apache Airflow vulnerable to Improper Encoding or Escaping of Output

apache/airflow · GHSA-c392-whpc-vfpr

high2024-09-07

CVE-2024-45034-Apache Airflow vulnerable to Execution with Unnecessary Privileges

apache/airflow · GHSA-92xg-gmrq-5c3w

medium2024-09-06

CVE-2022-46156-Default installation of `synthetic-monitoring-agent` exposes sensitive information

grafana/synthetic-monitoring-agent · GHSA-9j4f-f249-q5w8

medium2024-09-06

CVE-2022-24797-Exposure of debug and metrics endpoints in Pomerium

pomerium/pomerium · GHSA-q98f-2x4p-prjr

medium2024-09-06

CVE-2024-45405-gix-path improperly resolves configuration path reported by Git

byron/gitoxide · GHSA-m8rp-vv92-46c7

medium2024-09-06

CVE-2024-45039-gnark's Groth16 commitment extension unsound for more than one commitment

consensys/gnark · GHSA-q3hw-3gm4-w5cr

medium2024-09-06

HTML injection in JupyterLite leading to DOM Clobbering

jupyterlite/jupyterlite · GHSA-gj55-2xf9-67rq

high2024-09-06

CVE-2024-45294-XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`

hapifhir/org.hl7.fhir.core · GHSA-6cr6-ph3p-f5rf

high2024-09-06

CVE-2024-45040-gnark commitments to private witnesses in Groth16 as implemented break zero-knowledge property

consensys/gnark · GHSA-9xcg-3q8v-7fq6

critical2024-09-06

CVE-2024-45758-H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

h2oai/h2o-3 · GHSA-hrmc-jmp7-mpm2