Security advisories

low2024-05-01

CVE-2024-32882-Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

wagtail/wagtail · GHSA-w2v8-php4-p8hc

high2024-05-01

CVE-2023-36821-Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

louislam/uptime-kuma · GHSA-7grx-f945-mj96

medium2024-05-01

CVE-2023-36822-Uptime Kuma's authenticated path traversal via plugin repository name may lead to unavailability or data loss

louislam/uptime-kuma · GHSA-vr8x-74pm-6vj7

high2024-05-01

CVE-2024-32979-nautobot has reflected Cross-site Scripting potential in all object list views

nautobot/nautobot · GHSA-jxgr-gcj5-cqqg

medium2024-05-01

CVE-2024-32963-Navidrome Parameter Tampering vulnerability

navidrome/navidrome · GHSA-4jrx-5w4h-3gpm

high2024-04-30

CVE-2024-3154-CRI-O vulnerable to an arbitrary systemd property injection

cri-o/cri-o · GHSA-2cgq-h8xw-2v5j

high2024-04-30

CVE-2024-33522-Calico privilege escalation vulnerability

projectcalico/calico · GHSA-6362-gv4m-53ww

high2024-04-29

CVE-2023-46960-PyPXE Buffer Overflow vulnerability

pypxe/pypxe · GHSA-82wx-rxf8-fxch

high2024-04-29

CVE-2023-46565-Buffer Overflow vulnerability in osrg gobgp

osrg/gobgp · GHSA-6rqv-5cg7-m4x3

high2024-04-29

CVE-2024-31621-Flowise vulnerable to code injection via api/v1

flowiseai/flowise · GHSA-6wp6-22x5-rr3w

medium2024-04-28

CVE-2024-33883-ejs lacks certain pollution protection

mde/ejs · GHSA-ghr5-ch3p-vcr6

medium2024-04-27

CVE-2023-1000-dcnnt-py is vulnerable to command injection via Notification Handler

cyanomiko/dcnnt-py · GHSA-8p42-7597-p2f6

medium2024-04-27

CVE-2024-31828-Lavalite CMS Cross Site Scripting vulnerability

lavalite/cms · GHSA-5hcr-g32p-h74c

medium2024-04-26

CVE-2024-32887-Sidekiq vulnerable to a Reflected XSS in Queues Web Page

sidekiq/sidekiq · GHSA-q655-3pj8-9fxq

medium2024-04-26

CVE-2024-32476-Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences

argoproj/argo-cd · GHSA-9m6p-x4h2-6frq

low2024-04-26

CVE-2024-4195-Mattermost allows team admins to promote guests to team admins

mattermost/mattermost · GHSA-5fh7-7mw7-mmx5

medium2024-04-26

CVE-2024-4183-Mattermost fails to limit the number of active sessions

mattermost/mattermost · GHSA-wj37-mpq9-xrcm

medium2024-04-26

CVE-2024-32046-Mattermost's detailed error messages reveal the full file path

mattermost/mattermost · GHSA-vx97-8q8q-qgq5

low2024-04-26

CVE-2024-22091-Mattermost fails to limit the size of a request path

mattermost/mattermost · GHSA-p2wq-4ggp-45f3

medium2024-04-26

CVE-2024-4182-Mattermost crashes web clients via a malformed custom status

mattermost/mattermost · GHSA-8f99-g2pj-x8w3