Security advisories

high2023-11-17

CVE-2023-48238-json-web-token library is vulnerable to a JWT algorithm confusion attack

View chart →

joaquimserafim/json-web-token · GHSA-4xw9-cx39-r355

medium2023-11-17

CVE-2023-48294-LibreNMS has Broken Access control on Graphs Feature

View chart →

librenms/librenms · GHSA-fpq5-4vwm-78x4

medium2023-11-17

CVE-2023-48295-LibreNMS Cross-site Scripting at Device groups Deletion feature

View chart →

librenms/librenms · GHSA-8phr-637g-pxrg

medium2023-11-17

@vendure/core's insecure currencyCode handling allows wrong payment amounts

View chart →

vendure-ecommerce/vendure · GHSA-wm63-7627-ch33

critical2023-11-17

Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file

View chart →

ibis-project/ibis · GHSA-x563-6hqv-26mr

medium2023-11-17

CVE-2023-46745-LibreNMS vulnerable to rate limiting bypass on login page

View chart →

librenms/librenms · GHSA-rq42-58qf-v3qx

medium2023-11-17

CVE-2023-48648-Concrete CMS allows unauthorized access because directories can be created with insecure permissions

View chart →

concretecms/concretecms · GHSA-m87h-jxr6-f82w

low2023-11-17

CVE-2023-48649-Concrete CMS Cross-site Scripting vulnerability

View chart →

concretecms/concretecms · GHSA-36fr-3wg8-q5v8

high2023-11-17

CVE-2023-47025-Free5gc allows a local attacker to cause a denial of service via the free5gc-compose component

View chart →

free5gc/free5gc · GHSA-q27h-hw2v-x5jm

medium2023-11-17

CVE-2023-40314-OpenNMS Cross-site Scripting vulnerability

View chart →

opennms/opennms · GHSA-c6xw-hg9q-3c9f

critical2023-11-16

CVE-2023-6020-Ray Missing Authorization vulnerability

View chart →

ray-project/ray · GHSA-6cxr-8q3m-jwrr

critical2023-11-16

CVE-2023-6014-MLflow authentication requirement bypass can allow a user to arbitrarily create an account

View chart →

mlflow/mlflow · GHSA-4qq5-mxxx-m6gg

high2023-11-16

CVE-2023-48222-Authenticated Rundeck users can view or delete jobs they do not have authorization for.

View chart →

rundeck/rundeck · GHSA-phmw-jx86-x666

medium2023-11-16

CVE-2023-47112-Authenticated users can view job names and groups they do not have authorization to view

View chart →

rundeck/rundeck · GHSA-xvmv-4rx6-x6jx

critical2023-11-16

CVE-2023-6019-Ray OS Command Injection vulnerability

View chart →

ray-project/ray · GHSA-h3xg-wv58-5p43

high2023-11-16

CVE-2023-48056-PyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption

View chart →

bandoche/pypinksign · GHSA-fxff-wxxv-c2jc

critical2023-11-16

CVE-2023-6015-MLflow allowed arbitrary files to be PUT onto the server

View chart →

mlflow/mlflow · GHSA-f798-qm4r-23r5

high2023-11-16

CVE-2023-48052-HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack

View chart →

httpie/cli · GHSA-8r96-8889-qg2x

high2023-11-16

CVE-2023-48054-Missing SSL certificate validation in localstack

View chart →

localstack/localstack · GHSA-8633-g3ph-97rp

critical2023-11-16

CVE-2023-6038-H2O local file inclusion vulnerability

View chart →

h2oai/h2o-3 · GHSA-6mv8-95x5-xcq9