Security advisories

medium2024-03-28

CVE-2024-29888-Saleor: Customers' addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method

saleor/saleor · GHSA-mrj3-f2h4-7w45

high2024-03-28

CVE-2024-28860-Cilium has insecure IPsec transport encryption

cilium/cilium · GHSA-pwqm-x5x6-5586

high2024-03-28

CVE-2024-28233-Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing

jupyterhub/jupyterhub · GHSA-7r3h-4ph8-w38g

high2024-03-28

CVE-2024-29891-ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass

zitadel/zitadel · GHSA-hr5w-cwwq-2v4m

high2024-03-28

CVE-2024-29892-ZITADEL's actions can overload reserved claims

zitadel/zitadel · GHSA-gp8g-f42f-95q2

high2024-03-28

CVE-2024-25354-domain-suffix RegEx Denial of Service

ikrong/domain-suffix · GHSA-cqfh-c4c5-c2hg

high2024-03-28

CVE-2023-47438-SQL Injection vulnerability in Reportico Till

reportico-web/reportico · GHSA-jjf4-959w-f545

high2024-03-27

CVE-2024-21505-web3-utils Prototype Pollution vulnerability

web3/web3.js · GHSA-2g4c-8fpm-c46v

medium2024-03-27

CVE-2024-23451-Elasticsearch Incorrect Authorization vulnerability

elastic/elasticsearch · GHSA-r3hx-qfh5-r9m7

medium2024-03-27

CVE-2024-23450-Elasticsearch Uncontrolled Resource Consumption vulnerability

elastic/elasticsearch · GHSA-w5gg-2q56-6h4f

medium2024-03-27

CVE-2024-1023-Eclipse Vert.x memory leak

eclipse-vertx/vert.x · GHSA-5667-3wch-7q7w

high2024-03-27

CVE-2024-2206-gradio Server-Side Request Forgery vulnerability

gradio-app/gradio · GHSA-r364-m2j9-mf4h

high2024-03-26

CVE-2024-25421-Ignite Realtime Openfire privilege escalation vulnerability

igniterealtime/openfire · GHSA-6pwg-gg6j-5crm

high2024-03-26

CVE-2024-25420-Ignite Realtime Openfire privilege escalation vulnerability

igniterealtime/openfire · GHSA-5xvc-rwv8-86p7

medium2024-03-26

CVE-2024-29203-TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes

tinymce/tinymce · GHSA-438c-3975-5x3f

medium2024-03-26

CVE-2024-29881-TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements

tinymce/tinymce · GHSA-5359-pvf2-pw78

medium2024-03-26

CVE-2024-29197-Pimcore Preview Documents are not restricted to logged in users anymore

pimcore/pimcore · GHSA-5737-rqv4-v445

medium2024-03-26

CVE-2024-29735-Apache Airflow Improper Preservation of Permissions vulnerability

apache/airflow · GHSA-cff3-5qrp-hqx7

medium2024-03-26

CVE-2024-1455-LangChain's XMLOutputParser vulnerable to XML Entity Expansion

langchain-ai/langchain · GHSA-q84m-rmw3-4382

medium2024-03-26

CVE-2024-29644-dcat-admin Cross Site Scripting vulnerability

jqhph/dcat-admin · GHSA-mr24-cf69-5chq