Open Source Vulnerabilities

github.com/charmbracelet/soft-serve

charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-serve

github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2, github.com/imgproxy/imgproxy/v3, github.com/imgproxy/imgproxy/v4

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in github.com/imgproxy/imgproxy

github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2, github.com/imgproxy/imgproxy/v3, github.com/imgproxy/imgproxy/v4

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in github.com/imgproxy/imgproxy

github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2, github.com/imgproxy/imgproxy/v3, github.com/imgproxy/imgproxy/v4

imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field in github.com/imgproxy/imgproxy

github.com/kubeflow/pipelines

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory in github.com/kubeflow/pipelines

github.com/kubeflow/pipelines

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs in github.com/kubeflow/pipelines

github.com/siyuan-note/siyuan/kernel

SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files in github.com/siyuan-note/siyuan/kernel

github.com/ctfer-io/terraform-provider-ctfd, github.com/ctfer-io/terraform-provider-ctfd/v2

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values in github.com/ctfer-io/terraform-provider-ctfd

github.com/m1k1o/neko/server

Neko: Authorization bypass in legacy WebRTC input handling in github.com/m1k1o/neko/server

github.com/gtsteffaniak/filebrowser/backend

FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory in github.com/gtsteffaniak/filebrowser/backend

knative.dev/pkg

Admission webhooks allow unbounded request-body memory exhaustion in knative.dev/pkg

github.com/wailsapp/wails/v2

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins in github.com/wailsapp/wails

github.com/klauspost/compress

Panic on two-block frames in github.com/klauspost/compress

github.com/runatlantis/atlantis

OS command injection through PR-controlled Terraform workspace enables RCE during plan in github.com/runatlantis/atlantis

github.com/labstack/echo/v4, github.com/labstack/echo/v5

Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

github.com/labstack/echo/v4, github.com/labstack/echo/v5

URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

github.com/caddyserver/caddy/v2

Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through in github.com/caddyserver/caddy

github.com/labstack/echo/v4, github.com/labstack/echo/v5

Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

github.com/labstack/echo/v4, github.com/labstack/echo/v5

Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

github.com/labstack/echo/v4, github.com/labstack/echo/v5

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

github.com/labstack/echo/v4, github.com/labstack/echo/v5

Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

github.com/labstack/echo/v4, github.com/labstack/echo/v5

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

github.com/labstack/echo/v4, github.com/labstack/echo/v5

Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

github.com/labstack/echo/v4, github.com/labstack/echo/v5

Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

github.com/labstack/echo/v4, github.com/labstack/echo/v5

Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

github.com/siyuan-note/siyuan/kernel

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin in github.com/siyuan-note/siyuan/kernel

github.com/siyuan-note/siyuan/kernel

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in github.com/siyuan-note/siyuan/kernel

github.com/labstack/echo/v4, github.com/labstack/echo/v5

Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

github.com/labstack/echo/v4, github.com/labstack/echo/v5

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

github.com/labstack/echo/v4

Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

github.com/labstack/echo/v5

Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

github.com/labstack/echo/v4

Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

github.com/labstack/echo/v5

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

github.com/openchoreo/openchoreo

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs in github.com/openchoreo/openchoreo

github.com/moov-io/signedxml

Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization in github.com/moov-io/signedxml

github.com/distribution/distribution, github.com/distribution/distribution/v3, github.com/docker/distribution

Distribution: Client does not verify returned content against requested digest in github.com/distribution/distribution

github.com/getkin/kin-openapi

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion in github.com/getkin/kin-openapi

github.com/getkin/kin-openapi

kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path in github.com/getkin/kin-openapi

github.com/getkin/kin-openapi

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash in github.com/getkin/kin-openapi

github.com/getkin/kin-openapi

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression in github.com/getkin/kin-openapi

github.com/getkin/kin-openapi

kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) in github.com/getkin/kin-openapi

github.com/getkin/kin-openapi

kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items in github.com/getkin/kin-openapi

github.com/getkin/kin-openapi

kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path in github.com/getkin/kin-openapi

vitess.io/vitess

Vitess vttablet /twopcz reflected XSS in vitess.io/vitess

github.com/getkin/kin-openapi

kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter in github.com/getkin/kin-openapi

github.com/getkin/kin-openapi

kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content in github.com/getkin/kin-openapi

github.com/xuri/excelize/v2

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml in github.com/xuri/excelize