Security advisories

medium2024-04-12

CVE-2023-48865-Reportico affected by Incorrect Access Control

reportico-web/reportico · GHSA-pww3-x2g7-x8q2

high2024-04-11

CVE-2021-27915-Mautic vulnerable to stored cross-site scripting in description field

mautic/mautic · GHSA-2rc5-2755-v422

medium2024-04-11

CVE-2024-3651-Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode

kjd/idna · GHSA-jjg7-2v4v-x38h

medium2024-04-11

phin may include sensitive headers in subsequent requests after redirect

ethanent/phin · GHSA-x565-32qp-m3vf

medium2024-04-11

CVE-2024-32000-Matrix IRC Bridge truncated content of messages can be leaked

matrix-org/matrix-appservice-irc · GHSA-wm4w-7h2q-3pf7

medium2024-04-11

CVE-2024-29903-Cosign malicious artifacts can cause machine-wide DoS

sigstore/cosign · GHSA-95pr-fxf5-86gv

medium2024-04-11

CVE-2024-29902-Cosign malicious attachments can cause system-wide denial of service

sigstore/cosign · GHSA-88jx-383q-w4qc

medium2024-04-11

CVE-2023-29483-Potential DoS via the Tudoor mechanism in eventlet and dnspython

eventlet/eventlet · GHSA-3rq5-2g8h-59hc

medium2024-04-11

CVE-2024-31861-Code injection in Apache Zeppelin Shell

apache/zeppelin · GHSA-8pfj-w89w-m24x

critical2024-04-11

CVE-2024-21508-mysql2 Remote Code Execution (RCE) via the readCodeFor function

sidorares/node-mysql2 · GHSA-fpw7-j2hg-69v5

medium2024-04-11

CVE-2024-29504-Summernote vulnerable to cross-site scripting

summernote/summernote · GHSA-4wh3-3wf2-39m9

low2024-04-10

CVE-2024-32001-SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

authzed/spicedb · GHSA-j85q-46hg-36p2

critical2024-04-10

CVE-2024-32644-Evmos transaction execution not accounting for all state transition after interaction with precompiles

evmos/evmos · GHSA-3fp5-2xwh-fxm6

critical2024-04-10

CVE-2024-31819-WWBN AVideo Remote Code Execution

wwbn/avideo · GHSA-mv5w-wr5c-575p

critical2024-04-10

CVE-2024-2029-LocalAI Command Injection in audioToWav

mudler/localai · GHSA-wx43-g55g-2jf4

critical2024-04-10

CVE-2024-3098-llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution

run-llama/llama_index · GHSA-wvpx-g427-q9wc

critical2024-04-10

CVE-2024-2195-Aim Web API vulnerable to Remote Code Execution

aimhubio/aim · GHSA-mxvw-cj37-8g2h

high2024-04-10

CVE-2024-2196-Aim Cross-Site Request Forgery vulnerability allows user to delete runs and perform other operations

aimhubio/aim · GHSA-99w2-67h8-5948

critical2024-04-10

CVE-2024-2952-LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint

berriai/litellm · GHSA-46cm-pfwv-cgf8

low2024-04-10

CVE-2024-3568-Transformers Deserialization of Untrusted Data vulnerability

huggingface/transformers · GHSA-37q5-v5qm-c9v8