Open Source Vulnerabilities

mariadb

MariaDB v10

lame

lame_init_params function in lame

mariadb

MariaDB v10

opensearch-dashboards-3-anomaly-detection-dashboards-plugin, opensearch-dashboards-3-anomaly-detection-dashboards-plugin

qt6-qtbase

issue was discovered in HTTP2 in Qt before 5

mariadb

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB)

libuv

libuv is a multi-platform support library with a focus on asynchronous I/O

mariadb

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump)

gst-plugins-bad

GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

qt6-qtsvg

In Qt before 5

gst-plugins-bad

GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

gst-plugins-bad

GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability

gst-plugins-bad

GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability

gst-plugins-bad

GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

gst-plugins-bad

GStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

gst-plugins-bad

GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability

gst-plugins-bad

GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

raptor2

raptor_xml_writer_start_element_common in raptor_xml_writer

php85, php84, php83

In PHP 8

raptor2

malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common

php85, php84, php82, php83

In PHP versions 8

php85, php84, php82, php83

In PHP versions 8

php85, php84, php82, php83

In PHP versions 8

php85, php84, php82, php83

In PHP versions 8

gitaly

Security fix for GHSA-8392-8m93-v3w7 applied in: gitaly 14-9-3-r0

nodetaint, gitaly

Security fix for GHSA-69cg-p879-7622 applied in: nodetaint 0.0.4-r1, gitaly 14-9-3-r0

nodetaint, gitaly

Security fix for GHSA-4f99-4q7p-p3gh applied in: nodetaint 0.0.4-r1, gitaly 14-9-3-r0

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

nodetaint, gitaly

Security fix for GHSA-4374-p667-p6c8 applied in: nodetaint 0.0.4-r1, gitaly 14-9-3-r0

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

tar

nodetaint, falcosidekick, falcosidekick-fips, go-fips-1.24, gitaly

Security fix for GHSA-v778-237x-gjrc applied in: nodetaint 0.0.4-r1, falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0, go-fips-1.24 1.24.12-r0, gitaly 14-9-3-r0

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method

nodejs, nodejs

flaw in Node

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

When Conn

opensearch-dashboards-3-dashboards-reporting, opensearch-dashboards-3-dashboards-reporting

opensearch-dashboards-3-dashboards-reporting, opensearch-dashboards-3-dashboards-reporting

nodejs, nodejs

flaw in Node

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

nodejs, nodejs

We have identified a bug in Node

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

Reader

nats-server-fips, falcosidekick, falcosidekick-fips, go-fips-1.24

ParseAddress function constructs domain-literal address components through repeated string concatenation

nodejs, nodejs

flaw in Node

nodejs, nodejs

flaw in Node

go-fips-1.24, go-fips-1.24

When using http

nodejs, nodejs

malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node

gatekeeper, gatekeeper-fips, newrelic-k8s-metadata-injection, nats-server-fips, cloudflared, go-fips-1.24, go-fips-1.24

Downloading and building modules with malicious version strings can cause local code execution

nodejs, nodejs

Security fix for GHSA-73rr-hh4g-fpgx applied in: nodejs 25.4.0-r0, nodejs 25.4.0-r1