Security advisories

medium2024-02-26

CVE-2024-27456-Rack CORS Middleware has Insecure File Permissions

cyu/rack-cors · GHSA-785g-282q-pwvx

medium2024-02-26

CVE-2024-27447-pretix mishandles file validation

pretix/pretix · GHSA-672r-97r7-vx2q

low2024-02-26

CVE-2024-22371-Apache Camel data exposure vulnerability

apache/camel · GHSA-qpxm-689r-3849

low2024-02-26

CVE-2024-0243-langchain Server-Side Request Forgery vulnerability

langchain-ai/langchain · GHSA-h9j7-5xvc-qhg5

medium2024-02-26

CVE-2024-26481-Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field

getkirby/kirby · GHSA-57f2-8p89-66x6

medium2024-02-26

CVE-2024-26483-Kirby vulnerable to unrestricted file upload of user avatar images

getkirby/kirby · GHSA-xrvh-rvc4-5m43

medium2024-02-24

CVE-2024-21501-sanitize-html Information Exposure vulnerability

apostrophecms/sanitize-html · GHSA-rm97-x556-q36h

high2024-02-24

CVE-2024-21502-Uninitialized Variable in fastecdsa

antonkueltz/fastecdsa · GHSA-ph86-g9r3-5qw4

critical2024-02-24

CVE-2024-27132-Cross-site Scripting in MLFlow

mlflow/mlflow · GHSA-6749-m5cp-6cg7

critical2024-02-24

CVE-2024-27133-MLFlow Cross-site Scripting vulnerability leads to client-side Remote Code Execution

mlflow/mlflow · GHSA-3v79-q7ph-j75h

high2024-02-23

CVE-2024-27318-Onnx Directory Traversal vulnerability

onnx/onnx · GHSA-whh8-fjgc-qp73

high2024-02-23

CVE-2024-23320-Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users

apache/dolphinscheduler · GHSA-rc6h-qwj9-2c53

medium2024-02-23

CVE-2024-27319-Onnx Out-of-bounds Read vulnerability

onnx/onnx · GHSA-h8wv-9h96-m4hr

high2024-02-23

CVE-2024-26150-`@backstage/backend-common` vulnerable to path traversal through symlinks

backstage/backstage · GHSA-2fc9-xpp8-2g9h

high2024-02-23

CVE-2024-22243-Spring Web vulnerable to Open Redirect or Server Side Request Forgery

spring-projects/spring-framework · GHSA-ccgv-vj62-xf9h

high2024-02-23

CVE-2022-25377-Appwrite Directory Traversal vulnerability

appwrite/appwrite · GHSA-wfm3-gq9h-mrjm

medium2024-02-22

CVE-2024-1729-Gradio apps vulnerable to timing attacks to guess password

gradio-app/gradio · GHSA-hmx6-r76c-85g9

medium2024-02-22

CVE-2024-26152-Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config

humansignal/label-studio · GHSA-6xv9-957j-qfhg

high2024-02-22

pypqc private key retrieval vulnerability

jamestheawesomedude/pypqc · GHSA-rc4p-p3j9-6577

high2024-02-22

CVE-2024-26151-Potentially untrusted input is rendered as HTML in final output

felixschwarz/mjml-python · GHSA-578p-fxmm-6229