Security advisories

low2024-09-03

CometBFT's state syncing validator from malicious node may lead to a chain split

cometbft/cometbft · GHSA-g5xx-c4hv-9ccc

medium2024-09-03

CVE-2024-45310-runc can be confused to create empty files/directories on the host

opencontainers/runc · GHSA-jfvp-7x6p-h2pv

high2024-09-03

Pimcore includes vulnerable PHPOffice/PhpSpreadsheet

pimcore/pimcore · GHSA-hq76-662x-7mw4

medium2024-09-03

CVE-2024-45390-@blakeembrey/template vulnerable to code injection when attacker controls template input

blakeembrey/js-template · GHSA-q765-wm9j-66qj

high2024-09-03

CVE-2024-45391-Tina search token leak via lock file in TinaCMS

tinacms/tinacms · GHSA-4qrm-9h4r-v2fx

medium2024-09-03

CVE-2024-45389-DOM clobbering could escalate to Cross-site Scripting (XSS)

cloudcannon/pagefind · GHSA-gprj-6m2f-j9hx

medium2024-09-02

CVE-2020-36830-ReDoS in urlregex

nescalante/urlregex · GHSA-rw72-v6c7-hf9r

medium2024-08-31

CVE-2024-8285-Missing hostname validation in Kroxylicious

kroxylicious/kroxylicious · GHSA-h83p-72jv-g7vp

high2024-08-30

opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

opencv/opencv-python · GHSA-qr4w-53vh-m672

high2024-08-30

opencv-contrib-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

opencv/opencv-python · GHSA-cxjf-x6jp-p7mc

high2024-08-30

opencv-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

opencv/opencv-python · GHSA-jh2j-j4j9-crg3

high2024-08-30

opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

opencv/opencv-python · GHSA-w2pj-9cgh-mq2c

medium2024-08-30

Adyen APIs Library for Python timing attack vulnerability

adyen/adyen-python-api-library · GHSA-f3q4-ggfp-jv34

high2024-08-30

CVE-2023-26043-GeoServer style upload functionality vulnerable to XML External Entity (XXE) injection

geonode/geonode · GHSA-mcmc-c59m-pqq8

low2024-08-30

CVE-2023-23611-LTI 1.3 Grade Pass Back Implementation has Missing Authorization Vulnerability

openedx/xblock-lti-consumer · GHSA-7j9p-67mm-5g87

high2024-08-30

CVE-2021-21401-nanopb vulnerable to invalid free() call with oneofs and PB_ENABLE_MALLOC

nanopb/nanopb · GHSA-7mv5-5mxh-qg88

low2024-08-30

CVE-2020-15100-freewvs vulnerable to denial of service through large files

schokokeksorg/freewvs · GHSA-9cfv-9463-8gqv

low2024-08-30

CVE-2020-15101-freewvs's nested directory structure can interrupt scan

schokokeksorg/freewvs · GHSA-7pmh-vrww-25xx

high2024-08-30

CVE-2020-11093-Hyperledger Indy's update process of a DID does not check who signs the request

hyperledger/indy-node · GHSA-wh2w-39f4-rpv2

medium2024-08-30

CVE-2024-45047-Svelte has a potential mXSS vulnerability due to improper HTML escaping

sveltejs/svelte · GHSA-8266-84wp-wv5c