Open Source Vulnerabilities
Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
borgbackup, borgbackup, borgbackup, borgbackup2, borgbackup2, borgbackup2
borgbackup/ borgbackup/ borgbackup/ borgbackup2/ borgbackup2/ borgbackup2
python-oauthlib, python-oauthlib, python-oauthlib
Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
grafana-cloudmonitoring-datasource-fips
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment
Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF
KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF
NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF
borg extract might modify out-of-tree files when extracting maliciously crafted archives
borg extract might modify out-of-tree files when extracting maliciously crafted archives
Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)
Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
Black: GitHub Action installs unvalidated required-version from pyproject.toml
Black: GitHub Action installs unvalidated required-version from pyproject.toml
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS
libreoffice, libreoffice, libreoffice
org.springframework:spring-webmvc
TuxCare security update for org.springframework:spring-webmvc (1 CVE)
org.springframework:spring-webmvc
TuxCare security update for org.springframework:spring-webmvc (1 CVE)
