Open Source Vulnerabilities

imagemagick

zbar

openssh

debezium-server-3.7

nginx-prometheus-exporter-fips, haproxy-ingress, vault, vault, knative-serving, knative-serving, loki, loki, loki, loki, loki, loki, loki, loki

Security fix for GO-2026-5932 applied in: nginx-prometheus-exporter-fips 1.2.0-r0, haproxy-ingress 0.14.12-r9, vault 1.21.4-r16, knative-serving 1.20.3-r7, loki 3.4.6-r3, loki 3.4.6-r4

mailpit, grafana-alloy, caddy, istio-pilot-discovery, haproxy-ingress, haproxy-ingress, haproxy-ingress, dex, cert-manager, cert-manager, cert-manager, kube-state-metrics, kube-webhook-certgen, vault, vault, knative-serving, knative-serving, prometheus-alertmanager, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found

caddy, dex, cert-manager, cert-manager, cert-manager, vault, vault, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

dex, cert-manager, cert-manager, cert-manager, vault, vault, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

dex, cert-manager, cert-manager, cert-manager, vault, vault, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

mailpit, grafana-alloy, caddy, istio-pilot-discovery, haproxy-ingress, haproxy-ingress, haproxy-ingress, dex, cert-manager, cert-manager, cert-manager, kube-state-metrics, kube-webhook-certgen, vault, vault, knative-serving, knative-serving, prometheus-alertmanager, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki, loki

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n

loki, loki, loki, loki

Prometheus is an open-source monitoring system and time series database

loki, loki, loki, loki

Prometheus is an open-source monitoring system and time series database

loki, loki, loki, loki

Prometheus is an open-source monitoring system and time series database

loki, loki, loki, loki

Prometheus is an open-source monitoring system and time series database

spark-sc213-jdk17-py312, kafka

In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combin...

spark-sc213-jdk17-py312, kafka

In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by u...

kafka

Xerial snappy-java from 1

kafka

snappy-java through 1

kafka

snappy-java through 1

kafka

snappy-java through 1

kafka

Xerial snappy-java before 1

kafka

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google

kafka

Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object

kafka

In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/

kafka

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required)

kafka

vulnerability has been found in luben zstd-jni up to 1

kafka

In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context

kafka

In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case

kafka

client may issue specially crafted HTTP/1

kafka

unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path

sonarqube, sonarqube, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API

wso2mi, wso2mi, wso2mi, spark-sc213-jdk17-py312, sonarqube, sonarqube, sonarqube, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

sonarqube, elasticsearch, elasticsearch

Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

trino, sonarqube, sonarqube, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch

asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow c...

sonarqube, elasticsearch, elasticsearch

CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

trino, wso2mi, wso2mi, wso2mi, sonarqube, spark-sc213-jdk17-py312, kafka, sonarqube, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch, elasticsearch

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be ...

kafka

zstd-jni versions 1

kafka

zstd-jni versions 1

kafka

zstd-jni versions 1

wso2mi, wso2mi, wso2mi, sonarqube, sonarqube, elasticsearch, elasticsearch, elasticsearch, elasticsearch

In Bouncy Castle for Java before 1

wso2mi, wso2mi, wso2mi, sonarqube, sonarqube, elasticsearch, elasticsearch, elasticsearch, elasticsearch

In Bouncy Castle for Java before 1

sonarqube, sonarqube, elasticsearch, elasticsearch, elasticsearch, elasticsearch

In Bouncy Castle for Java before 1

sonarqube, sonarqube, elasticsearch, elasticsearch, elasticsearch, elasticsearch

In Bouncy Castle for Java before 1

elasticsearch, elasticsearch

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

elasticsearch, elasticsearch

vulnerability occurs when a client sends HTTP/1

sonarqube, sonarqube, elasticsearch, elasticsearch, elasticsearch, elasticsearch

In Bouncy Castle for Java before 1

sonarqube, sonarqube, elasticsearch, elasticsearch, elasticsearch, elasticsearch

In Bouncy Castle for Java before 1

spark-sc213-jdk17-py312, wso2mi, wso2mi, wso2mi, elasticsearch, elasticsearch, elasticsearch, elasticsearch

Netty netty-tcnative before 2

spark-sc213-jdk17-py312, wso2mi, wso2mi, wso2mi, elasticsearch, elasticsearch, elasticsearch, elasticsearch

Netty netty-tcnative before 2

spark-sc213-jdk17-py312, wso2mi, wso2mi, wso2mi, elasticsearch, elasticsearch, elasticsearch, elasticsearch

Netty netty-tcnative before 2