Security advisories

critical2024-03-05

CVE-2024-27922-HTTP Handling Vulnerability in the Bare server

tomphttp/bare-server-node · GHSA-86fc-f9gr-v533

high2024-03-05

CVE-2024-27916-`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user

stacklok/minder · GHSA-v627-69v2-xx37

medium2024-03-05

CVE-2024-27931-Insufficient permission checking in `Deno.makeTemp*` APIs

denoland/deno · GHSA-hrqr-jv8w-v9jh

medium2024-03-05

eth-abi is vulnerable to recursive DoS

ethereum/eth-abi · GHSA-3qwc-47jf-5rf7

high2024-03-04

CVE-2024-2048-Incorrect TLS certificate auth method in Vault

hashicorp/vault · GHSA-r3w7-mfpm-c2vw

high2024-03-04

CVE-2024-27918-Coder's OIDC authentication allows email with partially matching domain to register

coder/coder · GHSA-7cc2-r658-7xpf

high2024-03-04

pgproto3 SQL Injection via Protocol Message Size Overflow

jackc/pgproto3 · GHSA-7jwh-3vrq-q3m8

medium2024-03-04

CVE-2024-27915-Sulu grants access to pages regardless of role permissions

sulu/sulu · GHSA-jr83-m233-gg6p

high2024-03-04

CVE-2024-27308-Mio's tokens for named pipes may be delivered after deregistration

tokio-rs/mio · GHSA-r8w9-5wcg-vfj7

high2024-03-04

CVE-2024-27304-pgx SQL Injection via Protocol Message Size Overflow

jackc/pgx · GHSA-mrww-27vc-gghv

critical2024-03-04

CVE-2024-27307-JSONata expression can pollute the "Object" prototype

jsonata-js/jsonata · GHSA-fqg8-vfv7-8fj8

high2024-03-04

CVE-2024-27303-electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

electron-userland/electron-builder · GHSA-r4pf-3v7r-hh55

critical2024-03-04

CVE-2024-27302-Authorization Bypass Through User-Controlled Key in go-zero

zeromicro/go-zero · GHSA-fgxv-gw55-r5fq

high2024-03-04

CVE-2024-27289-pgx SQL Injection via Line Comment Creation

jackc/pgx · GHSA-m7wr-2xf7-cm9p

low2024-03-04

CVE-2024-28088-LangChain directory traversal vulnerability

langchain-ai/langchain · GHSA-h59x-p739-982c

medium2024-03-03

CVE-2024-25865-hexo-theme-anzhiyu Cross-site Scripting vulnerability

anzhiyu-c/hexo-theme-anzhiyu · GHSA-82jf-8f24-xq9m

high2024-03-01

CVE-2024-27101-Integer overflow in chunking helper causes dispatching to miss elements or panic

authzed/spicedb · GHSA-h3m7-rqc4-7h9p

medium2024-03-01

CVE-2024-27296-Directus version number disclosure

directus/directus · GHSA-5mhg-wv8w-p59j

high2024-03-01

CVE-2024-27081-ESPHome vulnerable to remote code execution via arbitrary file write

esphome/esphome · GHSA-8p25-3q46-8q2p

critical2024-03-01

Budibase affected by VM2 Constructor Escape Vulnerability

budibase/budibase · GHSA-4g2x-vq5p-5vj6