Security advisories

medium2024-02-27

CVE-2023-50380-Apache Ambari XML External Entity injection

apache/ambari · GHSA-qrp9-23p7-g5mf

medium2024-02-27

CVE-2024-21742-Apache James MIME4J improper input validation vulnerability

apache/james-mime4j · GHSA-jw7r-rxff-gv24

medium2024-02-27

CVE-2024-25399-Subrion CMS vulnerable to Cross Site Scripting

intelliants/subrion · GHSA-q4qh-8pxw-r48q

high2024-02-27

CVE-2024-25723-ZenML Server Remote Privilege Escalation Vulnerability

zenml-io/zenml · GHSA-vf7j-cmrj-pmmm

high2024-02-27

CVE-2023-51747-SMTP smuggling in Apache James

apache/james-project · GHSA-p5q9-86w4-2xr5

high2024-02-27

CVE-2023-50379-Apache Ambari: authenticated users could perform command injection to perform RCE

apache/ambari · GHSA-rghc-9fhx-h32m

high2024-02-27

CVE-2023-36237-Bagisto Cross-Site Request Forgery vulnerability

bagisto/bagisto · GHSA-7p7q-fjfw-v3gf

medium2024-02-26

CVE-2024-27093-Minder trusts client-provided mapping from repo name to upstream ID

stacklok/minder · GHSA-q6h8-4j2v-pjg4

medium2024-02-26

CVE-2024-1899-Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing

showdownjs/showdown · GHSA-rmmh-p597-ppvv

high2024-02-26

CVE-2024-22201-Connection leaking on idle timeout when TCP congested

jetty/jetty.project · GHSA-rggv-cv7r-mw98

low2024-02-26

CVE-2024-24564-Vyper's `extract32` can ready dirty memory

vyperlang/vyper · GHSA-4hwq-4cpm-8vmx

low2024-02-26

CVE-2024-26149-Vyper's `_abi_decode` vulnerable to Memory Overflow

vyperlang/vyper · GHSA-9p8r-4xp4-gw5w

critical2024-02-26

@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys

internet-identity-labs/sdk-ts · GHSA-84c3-j8r2-mcm8

critical2024-02-26

SAML authentication bypass due to missing validation on unsigned SAML messages

line/centraldogma · GHSA-hx5q-v6pj-533r

critical2024-02-26

CVE-2024-1735-Armeria SAML authentication bypass due to missing validation on unsigned SAML messages

line/armeria · GHSA-4m6j-23p2-8c54

low2024-02-26

PyPop C extensions possible vulnerability: missing arguments and redundant null pointers

alexlancaster/pypop · GHSA-p4m5-32pr-2hqr

low2024-02-26

CVE-2024-27088-es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`

medikoo/es5-ext · GHSA-4gmj-3p3h-gm8h

medium2024-02-26

CVE-2024-27087-Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" type

getkirby/kirby · GHSA-63h4-w25c-3qv4

critical2024-02-26

CVE-2024-27444-LangChain Experimental vulnerable to arbitrary code execution

langchain-ai/langchain · GHSA-v8vj-cv27-hjv8

high2024-02-26

CVE-2024-27454-orjson does not limit recursion for deeply nested JSON documents

ijl/orjson · GHSA-pwr2-4v36-6qpr