Open Source Vulnerabilities
org.springframework:spring-beans, org.springframework:spring-core
TuxCare security update for org.springframework (2 CVEs)
org.springframework:spring-beans/ org.springframework:spring-core
TuxCare security update for org.springframework (2 CVEs)
Immich calendar heatmap endpoint discloses cross-user activity through broken access control
Immich calendar heatmap endpoint discloses cross-user activity through broken access control
org.springframework:spring-webmvc
TuxCare security update for org.springframework:spring-webmvc (1 CVE)
org.springframework:spring-webmvc
TuxCare security update for org.springframework:spring-webmvc (1 CVE)
h5io before 0.2.6 Arbitrary Code Execution via read_hdf5
org.springframework:spring-context, org.springframework:spring-web
TuxCare security update for org.springframework (1 CVE)
org.springframework:spring-context/ org.springframework:spring-web
TuxCare security update for org.springframework (1 CVE)
ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()
ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()
ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders
ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders
ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)
ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)
OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth
OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth
OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval
OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval
OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)
OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)
OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution
OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution
OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`
OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`
GluonTS arbitrary file write during archive extraction
OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token
OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token
org.springframework:spring-context, org.springframework:spring-web
TuxCare security update for org.springframework (2 CVEs)
org.springframework:spring-context/ org.springframework:spring-web
TuxCare security update for org.springframework (2 CVEs)
OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)
OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)
OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data
OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data
org.springframework.security:spring-security-config, org.springframework.security:spring-security-core
TuxCare security update for org.springframework.security (1 CVE)
org.springframework.security:spring-security-config/ org.springframework.security:spring-security-core
TuxCare security update for org.springframework.security (1 CVE)
Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction
Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction
openssl-3.0.9, openssl-3.1.0, openssl-3.5.0
curl-8.1.1, curl-8.17.0, curl-8.8.0
openssl-1.0.1g, openssl-1.1.1c, openssl-1.1.1g, openssl-1.1.1k
openssl-1.0.1g/ openssl-1.1.1c/ openssl-1.1.1g/ openssl-1.1.1k
