Security advisories

medium2024-06-20

CVE-2024-34693-Apache Superset server arbitrary file read

apache/superset · GHSA-hcr7-cqwc-q5gq

high2024-06-20

CVE-2024-5182-LocalAI path traversal vulnerability

mudler/localai · GHSA-cpcx-r2gq-x893

medium2024-06-19

CVE-2024-38356-TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

tinymce/tinymce · GHSA-9hcv-j9pv-qmph

medium2024-06-19

CVE-2024-38357-TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

tinymce/tinymce · GHSA-w9jx-4g6g-rp7x

medium2024-06-19

CVE-2024-38355-socket.io has an unhandled 'error' event

socketio/socket.io · GHSA-25hc-qcg6-38wj

low2024-06-18

CVE-2024-58262-curve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`

dalek-cryptography/curve25519-dalek · GHSA-x4gp-pqpj-f43q

medium2024-06-18

CVE-2024-38273-Moodle BigBlueButton web service leaks meeting joining information

moodle/moodle · GHSA-x29x-qwvx-fxr2

medium2024-06-18

CVE-2024-38277-Moodle uses the same key for QR login and auto-login

moodle/moodle · GHSA-r82w-3phg-qvr4

high2024-06-18

CVE-2024-37821-Dolibarr arbitrary file upload vulnerability

dolibarr/dolibarr · GHSA-p7r8-7w87-8g46

medium2024-06-18

CVE-2024-38274-Moodle stored XSS via calendar's event title when deleting the event

moodle/moodle · GHSA-p5cg-6rfr-6mx8

medium2024-06-18

CVE-2024-38275-Moodle HTTP authorization header is preserved between "emulated redirects"

moodle/moodle · GHSA-p2cj-86v4-7782

medium2024-06-18

CVE-2024-38276-Moodle CSRF risks due to misuse of confirm_sesskey

moodle/moodle · GHSA-356g-7x36-7m34

medium2024-06-18

CVE-2024-38351-PocketBase performs password auth and OAuth2 unverified email linking

pocketbase/pocketbase · GHSA-m93w-4fxv-r35v

medium2024-06-18

CVE-2024-37904-Minder affected by denial of service from maliciously configured Git repository

stacklok/minder · GHSA-hpcg-xjq5-g666

high2024-06-17

CVE-2024-22032-Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec

rancher/rancher · GHSA-q6c7-56cq-g2wm

high2024-06-17

CVE-2023-32196-Rancher's External RoleTemplates can lead to privilege escalation

rancher/rancher · GHSA-64jq-m7rq-768h

critical2024-06-17

CVE-2023-32191-rke's credentials are stored in the RKE1 Cluster state ConfigMap

rancher/rke · GHSA-6gr4-52w6-vmqx

high2024-06-17

CVE-2023-22650-Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider

rancher/rancher · GHSA-9ghh-mmcq-8phc

medium2024-06-17

CVE-2024-37895-Lobe Chat API Key Leak

lobehub/lobe-chat · GHSA-p36r-qxgx-jq2v

medium2024-06-17

CVE-2024-37893-Firefly III has a MFA bypass in oauth flow

firefly-iii/firefly-iii · GHSA-4gm4-c4mh-4p7w