Security advisories

high2024-05-09

CVE-2024-34351-Next.js Server-Side Request Forgery in Server Actions

vercel/next.js · GHSA-fr5h-rqp8-mj6g

high2024-05-09

CVE-2024-34350-Next.js Vulnerable to HTTP Request Smuggling

vercel/next.js · GHSA-77r5-gw3j-2mpf

medium2024-05-09

CVE-2024-34352-1Panel arbitrary file write vulnerability

1panel-dev/1panel · GHSA-f8ch-w75v-c847

critical2024-05-09

CVE-2024-32874-Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service

blakeblackshear/frigate · GHSA-w4h6-9wrp-v5jq

high2024-05-09

CVE-2024-32655-Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow

npgsql/npgsql · GHSA-x9vc-6hfv-hg8c

high2024-05-08

CVE-2024-34345-@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

cyclonedx/cyclonedx-javascript-library · GHSA-38gf-rh2w-gmj7

critical2024-05-08

CVE-2024-32980-Spin applications with specific configuration vulnerable to potential network sandbox escape

fermyon/spin · GHSA-f3h7-gpjj-wcvh

critical2024-05-08

CVE-2024-26579-Apache Inlong Deserialization of Untrusted Data vulnerability

apache/inlong · GHSA-fgh3-pwmp-3qw3

high2024-05-08

CVE-2024-34346-Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag

denoland/deno · GHSA-23rx-c3g5-hv9w

medium2024-05-08

CVE-2024-32886-Vitess vulnerable to infinite memory consumption and vtgate crash

vitessio/vitess · GHSA-649x-hxfx-57j2

medium2024-05-07

CVE-2024-34517-Neo4j Cypher component mishandles IMMUTABLE privileges

neo4j/neo4j · GHSA-p343-9qwp-pqxv

low2024-05-07

CVE-2024-4596-Kimai information disclosure vulnerability

kimai/kimai · GHSA-6f3v-2r2j-2rpr

medium2024-05-07

CVE-2024-34341-Trix Editor Arbitrary Code Execution Vulnerability

basecamp/trix · GHSA-qjqp-xr96-cj99

high2024-05-07

CVE-2024-34342-react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js

wojtekmaj/react-pdf · GHSA-87hq-q4gp-9wr4

critical2024-05-07

CVE-2024-33434-tiagorlampert CHAOS vulnerable to arbitrary code execution

tiagorlampert/chaos · GHSA-xfjj-f699-rc79

medium2024-05-07

CVE-2024-4536-Eclipse Dataspace Components vulnerable to OAuth2 client secret disclosure

eclipse-edc/connector · GHSA-2x52-8f29-7cjr

medium2024-05-07

CVE-2024-28148-Apache Superset Incorrect Authorization vulnerability

apache/superset · GHSA-299q-3p96-5898

high2024-05-07

CVE-2024-34084-Minder's GitHub Webhook Handler vulnerable to DoS from un-validated requests

stacklok/minder · GHSA-9c5w-9q3f-3hv7

high2024-05-07

CVE-2024-4367-PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

mozilla/pdf.js · GHSA-wgrm-67xf-hhpq

critical2024-05-06

CVE-2024-34249-pywasm3 contains a heap buffer overflow which leads to segmentation fault

wasm3/pywasm3 · GHSA-mq9p-qw76-q6h7