Open Source Vulnerabilities

filelock

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

i18next-http-backend

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

io.opentelemetry:opentelemetry-api

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

knative-eventing-fips-1.24-channel-controller

knative-eventing-fips-1.24-channel-controller

knative-eventing-fips-1.24-channel-controller

knative-eventing-fips-1.24-channel-controller

happy-dom

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

vue-i18n, vue-i18n, @intlify/core, @intlify/core, @intlify/core-base, @intlify/core-base, petite-vue-i18n, petite-vue-i18n, @intlify/vue-i18n-core, @intlify/vue-i18n-core

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

vue-i18n, vue-i18n, vue-i18n, vue-i18n, petite-vue-i18n, petite-vue-i18n, petite-vue-i18n, petite-vue-i18n, @intlify/core-base, @intlify/core-base, @intlify/core-base, @intlify/core-base, @intlify/core, @intlify/core, @intlify/core, @intlify/core, @intlify/vue-i18n-core, @intlify/vue-i18n-core, @intlify/vue-i18n-core, @intlify/vue-i18n-core, @intlify/shared, @intlify/shared, @intlify/shared, @intlify/shared

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

happy-dom

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

langgraph-sdk, langgraph

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

@graphql-tools/executor-legacy-ws

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

@graphql-tools/executor-legacy-ws

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

@hono/node-server

@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

github.com/labstack/echo/v5, github.com/labstack/echo/v4

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

github.com/labstack/echo/v5, github.com/labstack/echo/v4

Echo static file middleware route protection bypass via encoded dot-dot traversal

github.com/labstack/echo/v5, github.com/labstack/echo/v4

Echo has a Static Middleware Double-Unescape Path Traversal

github.com/labstack/echo/v5, github.com/labstack/echo/v4

Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI

github.com/labstack/echo/v5, github.com/labstack/echo/v4

Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

zod

TuxCare security update for zod (1 CVE)

zod

TuxCare security update for zod (1 CVE)

knative-eventing-1.24-controller

knative-eventing-1.24-controller

knative-eventing-1.24-controller

knative-eventing-1.24-controller

knative-eventing-fips-1.24-channel-dispatcher

knative-eventing-fips-1.24-channel-dispatcher

knative-eventing-fips-1.24-channel-dispatcher

knative-eventing-fips-1.24-channel-dispatcher

knative-eventing-1.24-webhook

knative-eventing-1.24-webhook

knative-eventing-1.24-webhook

knative-eventing-1.24-webhook

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

knative-eventing-1.24-filter

knative-eventing-1.24-filter

knative-eventing-1.24-filter

knative-eventing-1.24-filter

knative-eventing-1.24-channel-dispatcher

knative-eventing-1.24-channel-dispatcher

knative-eventing-1.24-channel-dispatcher

knative-eventing-1.24-channel-dispatcher

knative-eventing-fips-1.24-ingress

knative-eventing-fips-1.24-ingress

knative-eventing-fips-1.24-ingress

knative-eventing-fips-1.24-ingress

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

eco-dotnet-libssl-1.0

eco-dotnet-libssl-1.0