Security advisories

medium2024-03-10

CVE-2024-2352-1Panel is vulnerable to command injection

1panel-dev/1panel · GHSA-x2vg-5wrf-vj6v

high2024-03-09

CVE-2024-28754-raspap-webgui vulnerable to denial of service

raspap/raspap-webgui · GHSA-vc9f-mgxr-h32r

high2024-03-08

CVE-2024-28184-WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

kozea/weasyprint · GHSA-35jj-wx47-4w8r

medium2024-03-08

CVE-2024-52288-LibOSDP RMAC revert to the beginning of the session

gotomain/libosdp · GHSA-xhjw-7vh5-qxqm

medium2024-03-08

CVE-2024-52296-LibOSDP vulnerable to a null pointer deref in osdp_reply_name

gotomain/libosdp · GHSA-7945-5mcv-f2pp

medium2024-03-08

CVE-2024-2319-Django MarkdownX Cross-Site Scripting (XSS) vulnerability

neutronx/django-markdownx · GHSA-fvx8-79hx-x82f

medium2024-03-08

CVE-2024-28122-JWX vulnerable to a denial of service attack using compressed JWE message

lestrrat-go/jwx · GHSA-hj3v-m684-v259

medium2024-03-07

CVE-2024-28180-Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

go-jose/go-jose · GHSA-c5q2-7r4c-mv6g

critical2024-03-07

CVE-2024-2044-pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user

pgadmin-org/pgadmin4 · GHSA-rj98-crf4-g69w

high2024-03-07

CVE-2024-1725-kubevirt-csi: PersistentVolume allows access to HCP's root node

kubevirt/csi-driver · GHSA-fg9q-5cw2-p6r9

high2024-03-07

CVE-2024-1442-Grafana's users with permissions to create a data source can CRUD all data sources

grafana/grafana · GHSA-5mxf-42f5-j782

medium2024-03-07

CVE-2024-28176-jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

panva/jose · GHSA-hhhv-q57g-882q

high2024-03-07

CVE-2024-28123-Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters

wasmi-labs/wasmi · GHSA-75jp-vq8x-h4cq

critical2024-03-07

CVE-2024-0818-PaddlePaddle Path Traversal vulnerability

paddlepaddle/paddle · GHSA-2rp8-hff9-c5wr

critical2024-03-07

CVE-2024-0917-PaddlePaddle vulnerable to remote code execution

paddlepaddle/paddle · GHSA-mrmm-qmrj-xgp6

critical2024-03-07

CVE-2024-28213-nGrinder vulnerable to unsafe Java objects deserialization

naver/ngrinder · GHSA-j7jm-8gf5-frcm

high2024-03-07

CVE-2024-0815-PaddlePaddle command injection in paddle.utils.download._wget_download

paddlepaddle/paddle · GHSA-qqv2-35q8-p2g2

high2024-03-07

CVE-2024-0817-PaddlePaddle command injection vulnerability

paddlepaddle/paddle · GHSA-fh54-3vhg-mpc2

high2024-03-06

CVE-2024-28110-Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

cloudevents/sdk-go · GHSA-5pf6-2qwx-pxm2

medium2024-03-06

CVE-2024-28102-JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

latchset/jwcrypto · GHSA-j857-7rvv-vj97